import sqlite3

def get_user_data(user_id):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    # CORRECT: Use parameterized queries to prevent SQL Injection
    # The database driver handles escaping values safely
    cursor.execute('SELECT username, email FROM users WHERE id = ?', (user_id,))
    user = cursor.fetchone()
    conn.close()
    return user

def update_user_email(user_id, new_email):
    conn = sqlite3.connect('database.db')
    cursor = conn.cursor()
    cursor.execute('UPDATE users SET email = ? WHERE id = ?', (new_email, user_id))
    conn.commit()
    conn.close()

# Example usage:
# user_id_input = '1 OR 1=1 --'
# user_data = get_user_data(user_id_input) # This would be safe and not return all users
# print(user_data)

# update_user_email(1, 'new_email@example.com')