Hibernate - strange order of native SQL parameters

Question

I am trying to use native MySQL's MD5 crypto func, so I defined custom insert in my mapping file.

<hibernate-mapping package="tutorial">
  <class name="com.xorty.mailclient.client.domain.User" table="user">
    <id name="login" type="string" column="login"></id>
    <property name="password">
        <column name="password" />
    </property>
    <sql-insert>INSERT INTO user (login,password) VALUES ( ?, MD5(?) )</sql-insert>
  </class>
</hibernate-mapping>

Then I create User (pretty simple POJO with just 2 Strings - login and password) and try to persist it.

session.beginTransaction();
// we have no such user in here yet
User junitUser = (User) session.load(User.class, "junit_user");
assert (null == junitUser);
// insert new user
junitUser = new User();
junitUser.setLogin("junit_user");
junitUser.setPassword("junitpass");
session.save(junitUser);
session.getTransaction().commit();

What actually happens?

User is created, but with reversed parameters order. He has login "junitpass" and "junit_user" is MD5 encrypted and stored as password.

What did I wrong? Thanks

EDIT: ADDING POJO class

package com.xorty.mailclient.client.domain;

import java.io.Serializable;

/**
 * POJO class representing user.
 * @author MisoV
 * @version 0.1
 */
public class User implements Serializable {

    /**
     * Generated UID
     */
    private static final long serialVersionUID = -969127095912324468L;
    private String login;
    private String password;

    /**
     * @return login
     */
    public String getLogin() {
        return login;
    }

    /**
     * @return password
     */
    public String getPassword() {
        return password;
    }

    /**
     * @param login the login to set
     */
    public void setLogin(String login) {
        this.login = login;
    }

    /**
     * @param password the password to set
     */
    public void setPassword(String password) {
        this.password = password;
    }

    /** 
     * @see java.lang.Object#toString()
     * @return login
     */
    @Override
    public String toString() {
        return login;
    }

    /**
     * Creates new User.
     * @param login User's login.
     * @param password User's password.
     */
    public User(String login, String password) {
        setLogin(login);
        setPassword(password);
    }

    /**
     * Default constructor
     */
    public User() {
    }

    /**
     * @return hashCode
     * @see java.lang.Object#hashCode()
     */
    @Override
    public int hashCode() {
        final int prime = 31;
        int result = 1;
        result = prime * result + ((null == login) ? 0 : login.hashCode());
        result = prime * result
                + ((null == password) ? 0 : password.hashCode());
        return result;
    }

    /**
     * @param obj Compared object
     * @return True, if objects are same. Else false.
     * @see java.lang.Object#equals(java.lang.Object)
     */
    @Override
    public boolean equals(Object obj) {
        if (this == obj) {
            return true;
        }
        if (obj == null) {
            return false;
        }
        if (!(obj instanceof User)) {
            return false;
        }
        User other = (User) obj;
        if (login == null) {
            if (other.login != null) {
                return false;
            }
        } else if (!login.equals(other.login)) {
            return false;
        }
        if (password == null) {
            if (other.password != null) {
                return false;
            }
        } else if (!password.equals(other.password)) {
            return false;
        }
        return true;
    }


}

Answer 1

From the docs:

The parameter order is important and is defined by the order Hibernate handles properties. You can see the expected order by enabling debug logging for the org.hibernate.persister.entity level. With this level enabled Hibernate will print out the static SQL that is used to create, update, delete etc. entities. (To see the expected sequence, remember to not include your custom SQL through annotations or mapping files as that will override the Hibernate generated static sql)

It sounds like there is no way to predict that order.