// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: java
// expected: SQL injection through dynamic table name construction

import java.sql.*;

public class ReportGenerator {
    private Connection conn;

    public ResultSet generateReport(String reportType, String startDate, String endDate)
            throws SQLException {
        // Vulnerable: reportType used as table name without sanitization
        String query = "SELECT * FROM " + reportType +
                       " WHERE created_at BETWEEN '" + startDate + "' AND '" + endDate + "'";
        Statement stmt = conn.createStatement();
        return stmt.executeQuery(query);
    }
}