how much safe from SQL-Injection if using hibernate

Question

Does Hibernate guard against SQL injection attack? If i am using hibernate then am i completely safe from SQL injection attack? I heard that Using Hibernate to execute a dynamic SQL statement built with user input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.

Answer 1

Does Hibernate guard against SQL injection attack?

No, it doesn't guard the wrongly written ones, So you need to be careful when you write the queries. Always use the prepared statement style, for example consider the below HQL queries,

String query1 = "select * from MyBean where id = "+ id;
String query2 = "select * from MyBean where id = :id";

query1 ** is still vulnerable to **SQL Injection where as query2 is not.

So In short hibernate provides you many ways that you should use to guard yourself from the SQL Injection attacks.