Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public static String convertToSQL92(
            char escape, char multi, char single, boolean matchCase, String pattern)
            throws IllegalArgumentException {
        if ((escape == '\'') || (multi == '\'') || (single == '\''))
            throw new IllegalArgumentException("do not use single quote (') as special char!");

        StringBuffer result = new StringBuffer(pattern.length() + 5);
        for (int i = 0; i < pattern.length(); i++) {
            char chr = pattern.charAt(i);
            if (chr == escape) {
                // emit the next char and skip it
                if (i != (pattern.length() - 1)) result.append(pattern.charAt(i + 1)); //
                i++; // skip next char
            } else if (chr == single) {
                result.append('_');
            } else if (chr == multi) {
                result.append('%');
            } else if (chr == '\'') {
                result.append('\'');
                result.append('\'');
            } else {
                result.append(matchCase ? chr : Character.toUpperCase(chr));
            }
        }

        return result.toString();
    }