import os

def get_user(conn, user_id):
    cur = conn.cursor()
    cur.execute("SELECT * FROM users WHERE id = " + user_id)   # SQL injection (CWE-89)
    return cur.fetchall()

def ping(host):
    os.system("ping -c 1 " + host)                              # command injection (CWE-78)