hi,

i tried to test if my application (which is based upon hibernate) is safe against sql injection. ok nothing happened, but maybe i don't have the cleverness of a hacker and he could do it...

Do you know how secure hibernate is and what i could do? Somewhere i read prepared statements could protect.

thanks and kind regards,
jazz

Hibernate only uses PreparedStatements, so you are safe from SQL injection attacks if you use bind parameters properly and don't concat query strings and user input.

thank you.