# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: ruby
# expected: Raw SQL executed via connection.execute with user input

def run_analytics(dimension, filter_expr)
  sql = "SELECT #{dimension}, COUNT(*) FROM events WHERE #{filter_expr} GROUP BY #{dimension}"
  ActiveRecord::Base.connection.execute(sql)
end

def delete_records(table, condition)
  ActiveRecord::Base.connection.execute(
    "DELETE FROM #{table} WHERE #{condition}"
  )
end

def update_field(table, field, value, id)
  ActiveRecord::Base.connection.execute(
    "UPDATE #{table} SET #{field} = '#{value}' WHERE id = #{id}"
  )
end