# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: python
# expected: SQL injection via .format() string interpolation in Django raw query

from django.db import connection
from django.http import JsonResponse


def search_articles(request):
    query = request.GET.get("q", "")
    tag = request.GET.get("tag", "")
    author = request.GET.get("author", "")

    with connection.cursor() as cursor:
        # All three params injected via .format()
        sql = """
            SELECT a.id, a.title, a.summary, u.username as author
            FROM articles a
            JOIN users u ON a.author_id = u.id
            WHERE a.published = true
            AND (a.title ILIKE '%{query}%' OR a.content ILIKE '%{query}%')
            AND a.tag = '{tag}'
            AND u.username = '{author}'
            ORDER BY a.created_at DESC
        """.format(query=query, tag=tag, author=author)
        cursor.execute(sql)
        cols = [col[0] for col in cursor.description]
        return JsonResponse({"results": [dict(zip(cols, row)) for row in cursor.fetchall()]})