```python
"""
Red-team review of code_review.py.txt

This module demonstrates SQL injection in the vulnerable `find_customer` function
and compares it with the parameterized version using an in-memory SQLite database.
"""

import sqlite3


def setup_db():
    """Create an in-memory SQLite DB with two customers."""
    conn = sqlite3.connect(":memory:")
    cur = conn.cursor()
    cur.execute("""
        CREATE TABLE customers (
            id INTEGER PRIMARY KEY,
            name TEXT NOT NULL,
            email TEXT NOT NULL
        )
    """)
    # Two customers: Alice and Bob
    cur.executemany(
        "INSERT INTO customers (id, name, email) VALUES (?, ?, ?)",
        [
            (1, "Alice", "alice@example.com"),
            (2, "Bob", "bob@example.com"),
        ],
    )
    conn.commit()
    return conn


# --- Reproduce the functions from code_review.py.txt ---

def find_customer(connection, name):
    """Vulnerable: string interpolation."""
    query = f"SELECT id, name, email FROM customers WHERE name = '{name}'"
    return connection.execute(query).fetchall()


def find_customer_parameterized(connection, name):
    """Safe: parameterized query."""
    query = "SELECT id, name, email FROM customers WHERE name = ?"
    return connection.execute(query, (name,)).fetchall()


# --- Red-team demonstration ---

if __name__ == "__main__":
    conn = setup_db()

    # Normal input: look up "Alice"
    print("=== Normal lookup: 'Alice' ===")
    print("Vulnerable:", find_customer(conn, "Alice"))
    print("Parameterized:", find_customer_parameterized(conn, "Alice"))

    # Injection payload: classic tautology
    payload = "' OR 1=1 --"
    print(f"\n=== Injection payload: {payload!r} ===")

    vuln_rows = find_customer(conn, payload)
    param_rows = find_customer_parameterized(conn, payload)

    print("Vulnerable result:", vuln_rows)
    print("Row count (vulnerable):", len(vuln_rows))
    print("Parameterized result:", param_rows)
    print("Row count (parameterized):", len(param_rows))

    # Explain what happened
    print("\n=== Explanation ===")
    print(f"Vulnerable query executed:")
    print(f"  SELECT id, name, email FROM customers WHERE name = '{payload}'")
    print("  After SQL parsing: WHERE name = '' OR 1=1 --'")
    print("  The '--' comments out the closing quote, so the condition becomes a tautology.")
    print(f"  With 2 rows in the table, it returns {len(vuln_rows)} rows (all customers).")
    print()
    print("Parameterized query executed:")
    print("  SELECT id, name, email FROM customers WHERE name = ?")
    print(f"  The literal string {payload!r} is bound as a single value.")
    print(f"  No customer has that exact name, so it returns {len(param_rows)} rows (zero).")

    conn.close()
```