diff --git a/mock-bug.js b/mock-bug.js
index e9279c8..53d195c 100644
Binary files a/mock-bug.js and b/mock-bug.js differ
diff --git a/vulnerable-test.js b/vulnerable-test.js
new file mode 100644
index 0000000..8b5c66e
--- /dev/null
+++ b/vulnerable-test.js
@@ -0,0 +1,13 @@
+const sqlite3 = require('sqlite3').verbose();
+const db = new sqlite3.Database(':memory:');
+
+function getUser(id) {
+    const query = "SELECT * FROM users WHERE id = " + id;
+    db.get(query, (err, row) => {
+        if (err) console.error(err);
+        console.log(row);
+    });
+}
+
+const userId = "1 OR 1=1";
+getUser(userId);
diff --git a/vulnerable.js b/vulnerable.js
new file mode 100644
index 0000000..04f6f19
--- /dev/null
+++ b/vulnerable.js
@@ -0,0 +1,6 @@
+function getUser(id) {
+    // TODO: Fix injection
+    const query = `SELECT * FROM users WHERE id = ${id}`;
+    return query;
+}
+module.exports = { getUser };