#!/usr/bin/env python3
"""Local SQL injection demonstration. Uses only a temporary in-memory database."""
import json
import sqlite3


def vulnerable_lookup(connection, name):
    query = f"SELECT id, name, email FROM customers WHERE name = '{name}'"
    return connection.execute(query).fetchall()


def parameterized_lookup(connection, name):
    query = 'SELECT id, name, email FROM customers WHERE name = ?'
    return connection.execute(query, (name,)).fetchall()


def run():
    connection = sqlite3.connect(':memory:')
    try:
        connection.execute('CREATE TABLE customers (id INTEGER, name TEXT, email TEXT)')
        connection.executemany('INSERT INTO customers VALUES (?, ?, ?)', [
            (1, 'Alice', 'alice@example.invalid'),
            (2, "O'Connor", 'oconnor@example.invalid'),
        ])
        proof = "' OR 1=1 -- "
        vulnerable_rows = vulnerable_lookup(connection, proof)
        corrected_rows = parameterized_lookup(connection, proof)
        assert len(vulnerable_rows) == 2
        assert corrected_rows == []
        assert parameterized_lookup(connection, "O'Connor")[0][1] == "O'Connor"
        assert parameterized_lookup(connection, 'missing') == []
        result = {'database': ':memory:', 'proof_input': proof, 'vulnerable_rows': len(vulnerable_rows), 'parameterized_rows': len(corrected_rows)}
        print(json.dumps(result, indent=2))
        return result
    finally:
        connection.close()


if __name__ == '__main__':
    run()