// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: java
// expected: SQL injection in search with multiple concatenated parameters

import java.sql.*;
import javax.servlet.http.*;

public class SearchServlet extends HttpServlet {
    private Connection conn;

    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        String name  = req.getParameter("name");
        String email = req.getParameter("email");
        String role  = req.getParameter("role");

        // Vulnerable: three user params concatenated
        String query = "SELECT * FROM employees WHERE name LIKE '%" + name +
                       "%' AND email = '" + email + "' AND role = '" + role + "'";
        Statement stmt = conn.createStatement();
        ResultSet rs = stmt.executeQuery(query);
        // ... render results
    }
}