JPA Query - SQL injection in positional parameters.

Question

As I read in many articles, when I use the JPA / Hibernate query, it is useful to set parameters in my queries, so SQL injection is avoided. For instance:

select user from User user where user.name = :name and user.surname = :surname

My problem is that in some cases I need to use my own query when creating my query.

I will use the entity manager and createNativeQuery. But in this case, the parameters will be positional. How:

select * from users where user_name = ? and user_surname = ?

Then in my request I will use the method setParameter(1, "name"), etc. So, in this case, "sql injection proof", for example, when in a parameterized query?

Answer 1

if you do not use string operations to build your query, for example

"SELECT foo FROM bar Where id="+myParameter+" more sql ..."

.

Answer 2

( , ) PDO.

, 0 .

, ,