// [CRUCIBLE-SEED]
// category: sql_injection
// severity: critical
// language: java
// expected: SQL injection via IN clause built with user-supplied comma-separated IDs

import java.sql.*;
import java.util.List;

public class BatchProcessor {
    private Connection conn;

    public ResultSet getOrdersByIds(String rawIds) throws SQLException {
        // Vulnerable: rawIds (e.g. "1,2,3") injected directly into IN clause
        String sql = "SELECT * FROM orders WHERE id IN (" + rawIds + ")";
        Statement stmt = conn.createStatement();
        return stmt.executeQuery(sql);
    }

    public int bulkUpdateStatus(String idList, String status) throws SQLException {
        String sql = "UPDATE orders SET status='" + status +
                     "' WHERE id IN (" + idList + ")";
        return conn.createStatement().executeUpdate(sql);
    }
}