# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: ruby
# expected: SQL injection via string interpolation in ActiveRecord where()

class UserController < ApplicationController
  def search
    username = params[:username]
    @users = User.where("username = '#{username}'")
    render json: @users
  end

  def filter
    role  = params[:role]
    since = params[:since]
    @records = User.where("role = '#{role}' AND created_at >= '#{since}'")
    render json: @records
  end
end