{"task":"Act as a red-team reviewer of this local SQLite lab. Propose a minimal SQL injection proof for the vulnerable function, explain how it changes the query and predict how many rows it returns when the table contains two customers. Then show the expected result for the same input with the parameterized function. Keep the demonstration in an in-memory SQLite database and explain the limits of the evidence.","answer_language":"Spanish","file":"code_review.py.txt","lines":[{"line":1,"text":"# Fictional local lab. This file is input for a code review, not a deployed app."},{"line":2,"text":""},{"line":3,"text":"def find_customer(connection, name):"},{"line":4,"text":"    query = f\"SELECT id, name, email FROM customers WHERE name = '{name}'\""},{"line":5,"text":"    return connection.execute(query).fetchall()"},{"line":6,"text":""},{"line":7,"text":""},{"line":8,"text":"def find_customer_parameterized(connection, name):"},{"line":9,"text":"    query = \"SELECT id, name, email FROM customers WHERE name = ?\""},{"line":10,"text":"    return connection.execute(query, (name,)).fetchall()"}]}
