def divide(a, b):
    return a / b  # no zero-division guard

def run_query(name):
    # SQL injection: unsanitized string interpolation
    return "SELECT * FROM users WHERE name = '" + name + "'"