JPA Query - sql injection in positional parameters jpa native query

Question

As I read in a lot of articles, when I use JPA/Hibernate query it is good to set parameters in my queries so SQL injection is avoided. Like: ``` select user from User user where user.name = :name and user.surname = :surname ``` My problem is that in some cases I need to use native query when I create my query. I will use my entity manager and `createNativeQuery`. But in this case the parameters will be positional. Like: ``` select * from users where user_name = ? and user_surname = ? ``` Then in my query I will use the method `setParameter(1, "name")` etc. So is this case "sql injection proof" like when in the parameterized query?

Accepted Answer

if you do not use string operations for building your query like

```
"SELECT foo FROM bar Where id="+myParameter+" more sql ..."
```

, then you will not have any vulnerabilities.

JPA Query - sql injection in positional parameters jpa native query

Solution

Problem