// Unprepared SQL query
class C {
	static String out = "";
    static public void main(String[] args) {
		String dbDriver = "com.mysql.jdbc.Driver";
		String strConn = "jdbc:mysql://localhost/database";
		String dbUser = "admin";
		String dbPassword = "pass";
		// generate query to send 
		String sanitizedName = args[0];
		String sanitizedCardType = args[1];
		String query = "SELECT cardnum FROM accounts" + " WHERE uname=’" + sanitizedName
			+ "’" + " AND cardtype=" + sanitizedCardType + ";";
		try { 
			java.sql.Connection conn = java.sql.DriverManager.getConnection(strConn, dbUser, dbPassword);
			java.sql.Statement stmt = conn.createStatement(); 
			java.sql.ResultSet rs = stmt.executeQuery(query); //unknown deps/side-effects
			// generate html output 
			out += "<html><body><table>"; 
			while(rs.next()) {
				out += ("<tr> <td>"); 
				out += (rs.getString(1)); 
				out += ("</td> </tr>");
			} 
			if (rs != null) {
				rs.close();
			}
			out += ("</table> </body> </html>"); 
		} catch (Exception e) {
			out += (e.toString()); 
		}
	}
}
