# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: python
# expected: SQL injection via string formatting in cursor.execute

import sqlite3


def get_user_by_name(username: str) -> dict:
    conn = sqlite3.connect("app.db")
    cursor = conn.cursor()
    # Direct string formatting — attacker sends: "' OR '1'='1"
    query = "SELECT * FROM users WHERE username = '%s'" % username
    cursor.execute(query)
    row = cursor.fetchone()
    conn.close()
    return row


def search_products(term: str, category: str) -> list:
    conn = sqlite3.connect("app.db")
    cursor = conn.cursor()
    query = (
        "SELECT * FROM products WHERE name LIKE '%%%s%%' AND category = '%s'" % (term, category)
    )
    cursor.execute(query)
    results = cursor.fetchall()
    conn.close()
    return results


def delete_user(user_id: str) -> None:
    conn = sqlite3.connect("app.db")
    cursor = conn.cursor()
    cursor.execute("DELETE FROM users WHERE id = " + user_id)
    conn.commit()
    conn.close()