SQL Injection Attacks

[Bai Shen]

I have a search servlet that runs a query on my database. Right now the query looks something like this, where variable is a parameter I get from the ServletRequest.

s.createQuery("FROM table WHERE NAME = '"+variable+"'").list();

AFAIK, you have to do prepared statements in Java to avoid SQL injection attacks. Does my using HQL absolve that, or do I need to change my query?

[Bauke Scholtz]

No, it doesn´t. Yes, you need to change it a parameterized query and make use of the parameter setters.

[Bai Shen]

How would I go about doing that using HQL vs SQL?

[Bauke Scholtz]

Bai Shen wrote:How would I go about doing that using HQL vs SQL?

Uh, just the same way? The Query API provides setters for it, like as PreparedStatement has.

Edit: reading the API documentation and the reference document may lighten things up:
http://www.hibernate.org/hib_docs/v3/api/org/hibernate/Query.html
http://www.hibernate.org/hib_docs/reference/en/html/objectstate-querying.html