Are SQL injection attacks possible in JPA?

jpa orm sql-injection jpql
Akshay picture Akshay · Aug 9, 2010 · Viewed 40.8k times · Source

I'm building a Java Web Application using Java EE 6 and JSF-2.0, using the persistence API for all database operations.

The back-end is MySQL, but I have used the EntityManager functions and Named Queries in EJB-QL for all operations. Are SQL injection attacks possible in this case?

Answer

BalusC picture BalusC · Aug 9, 2010

It's only possible if you're inlining user-controlled variables in a SQL/JPQL string like so:

String sql = "SELECT u FROM User u WHERE id=" + id;

If you aren't doing that and are using parameterized/named queries only, then you're safe.

Related questions

How to fix the Hibernate "object references an unsaved transient instance - save the transient instance before flushing" error

I receive following error when I save the object using Hibernate object references an unsaved transient instance - save the transient instance before flushing

Read More
What's the difference between JPA and Hibernate?

I understand that JPA 2 is a specification and Hibernate is a tool for ORM. Also, I understand that Hibernate has more features than JPA 2. But from a practical point of view, what really is the difference? I have experience using …

Read More
Difference between FetchType LAZY and EAGER in Java Persistence API?

I am a newbie to Java Persistence API and Hibernate. What is the difference between FetchType.LAZY and FetchType.EAGER in Java Persistence API?

Read More