Build (Conceptually) Safe Queries

A SQL-builder exercise without a database. Implement in Solution: - record Param(String value) - static String buildFind(String table, Param id) returning "SELECT * FROM " + table + " WHERE id = ?" — the placeholder, NOT the value (demonstrating parameter binding). - static String buildFindUnsafe(String table, String id) returning the concatenated version "SELECT * FROM " + table + " WHERE id = '" + id + "'". The tests demonstrate the attack: an id of x' OR '1'='1 produces a harmless placeholder string in the safe builder and a *broken/injected* query in the unsafe one — making the vulnerability visible.

Difficulty: intermediate