Citi interview question

polymorphism, arraylist, sql injection