如何防止JPA中的sql注入

Question

I am using below jpa code. How can we prevent below code from sql injections?

List<Document> docs= em.createQuery("SELECT c FROM Document c WHERE c.docId = :docId ", Document.class)
                .setParameter("docId", docId).getResultList();

http://www.adam-bien.com/roller/abien/entry/preventing_injection_in_jpa_query

Answer 1

It already is protected against SQL injection. Your code is using parameters. Also if you want, you can use Criteria APIs to build the same query.