// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: java
// expected: SQL injection via stored procedure call with string concatenation

import java.sql.*;

public class AuditLogger {
    private Connection conn;

    public void logEvent(String userId, String action, String detail) throws SQLException {
        // Vulnerable: detail field concatenated into EXEC call
        String sql = "EXEC sp_log_audit '" + userId + "', '" + action + "', '" + detail + "'";
        Statement stmt = conn.createStatement();
        stmt.execute(sql);
    }

    public ResultSet getAuditTrail(String fromDate) throws SQLException {
        String query = "SELECT * FROM audit_log WHERE event_time >= '" + fromDate + "'";
        return conn.createStatement().executeQuery(query);
    }
}