What vulnerabilities do you find in this code snipplet? 	public static boolean isValidUser(NAME_1 user, NAME_1 password) throws SQLException{
		if (user == null || password == null || user.trim().length() == 0 || password.trim().length() == 0)
			return false; 
		
		Connection connection = getConnection();
		Statement statement = connection.createStatement();
		NAME_1 sentencia;
		sentencia = "SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '_1' AND PASSWORD='_2'";
		sentencia = sentencia.replaceAll("_1", user);
		sentencia = sentencia.replaceAll("_2", password);
		ResultSet resultSet =statement.executeQuery(sentencia); /* BAD - user input should always be sanitized */
		
return false; }