What specific steps, if any, does NHibernate take to prevent SQL Injection when persisting objects, et al?


I googled around and couldn't really find anything so I wasn't quite sure.


Thanks

You rarely if ever need to use SQL directly.
working with parameters is a breeze.
There is an OOP API that you can use to abstract the query building from you

Even if you are concentrating strings, you are using HQL, and not SQL, meaning that it will fail to parse before being passed to the server.