The assistant wrote a search repository method. Find the problem.

public List<Product> search(String name, String sortBy) {
    String sql = "SELECT * FROM products WHERE name LIKE '%" + name + "%'"
               + " ORDER BY " + sortBy;
    return jdbcTemplate.query(sql, productRowMapper);
}