import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import javax.servlet.http.HttpServletRequest;

public class SqlInjectionConcat {
    public ResultSet findUser(Connection conn, HttpServletRequest request) throws Exception {
        String name = request.getParameter("name");
        String sql = "SELECT * FROM users WHERE name = '" + name + "'";
        PreparedStatement ps = conn.prepareStatement(sql);
        return ps.executeQuery();
    }
}