# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: ruby
# expected: Sequel dataset filter with string interpolation

require 'sequel'

DB = Sequel.connect('sqlite://db/production.sqlite3')

def find_user(username, password)
  DB[:users].where("username = '#{username}' AND password = '#{password}'").first
end

def get_orders(status, user_id)
  DB[:orders].where("status = '#{status}' AND user_id = #{user_id}").all
end

def search_items(keyword)
  DB[:items].where("name LIKE '%#{keyword}%' OR description LIKE '%#{keyword}%'").all
end