// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: java
// expected: SQL injection via string concatenation in login query

import java.sql.*;
import javax.servlet.http.*;

public class LoginServlet extends HttpServlet {
    private Connection conn;

    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        String user = req.getParameter("username");
        String pass = req.getParameter("password");

        // Vulnerable: both parameters concatenated directly
        String sql = "SELECT id FROM accounts WHERE username='" + user +
                     "' AND password='" + pass + "'";
        Statement st = conn.createStatement();
        ResultSet rs = st.executeQuery(sql);
        if (rs.next()) {
            req.getSession().setAttribute("userId", rs.getInt("id"));
            resp.sendRedirect("/dashboard");
        } else {
            resp.sendRedirect("/login?error=1");
        }
    }
}