Hi,

We use HQL for generating queries in our code and recently a user asked about SQL injection attacks. I was wondering if there was any kind of useful method I could pass my user input to to before doing the HQL that could transform quotes/parse out sql commands, etc to make my life easier. I understand that in general every query needs to be treated differently but something that could be useful as a first pass would be nice.


Thanks, Jason

From what i know, Hibernate users PreparedStatements but i might be wrong. In which case, SQL injection is far less lightly to be a threat to your database.