<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="text-align: justify;">
<div dir="ltr" style="color: #20124d; text-align: left;">
<p>In this tutorial of SQL Injection and Parameter Binding in Hibernate we will discuss about SQL inject and its demerits and also describe Parameter binding, it means is way to bind parameter with SQL to use in the hibernate for particular criteria.</p>
<h2>SQL Injection:</h2>
</div>
<div style="color: #20124d;">Injecting the value to the SQL statement. SQL injection refers to the act of someone inserting a MySQL statement to be run on your database without your knowledge. Injection usually occurs when you ask a user for input, like their name, and instead of a name they give you a MySQL statement that you will unknowingly run on your database.</div>
<h2 class="specialT" style="color: #20124d;"></h2>
<div class="display" style="color: #20124d;"><b>Normal:</b> &#8221; SELECT * FROM student WHERE studentName= &#8216;sweety'&#8221;<br />
<b>Injection:</b> &#8220;SELECT * FROM student WHERE studentName= &#8221; +studentName</div>
<div style="color: #20124d;">
<div style="color: #20124d;"></div>
<p>It is a very common misconception that ORM solutions, like hibernate, are SQL Injection proof. Hibernate allows the use of &#8220;native SQL&#8221; and defines a proprietary query language, named, HQL the former is prone to SQL Injection and the later is prone to HQL injection.</p>
<p> ;</p>
<div class="separator" style="clear: both; text-align: center;"><img src="https://dineshonjava.com/wp-content/uploads/2017/04/sql-injection-and-entity-frameworks.jpg" border="0" /></div>
<p><b><i>@ImageSource-Slideshare.net</i></b></p>
<h2 style="color: #20124d;">Parameter Binding:</h2>
</div>
</div>
<div style="color: #20124d;">A bind variable is a named placeholder (preceded by a colon) that is embedded in the query string in place of a literal. The actual value is substituted at runtime using the setParameter() method.</div>
<p>Without parameter binding, you have to concatenate the parameter String like this (bad code) :</p>
</div>
<pre class="highlight">String hql = "from Student student where student.studentName = '" + studentName+ "'"; 
Query query = session.createQuery(hql); 
List result = query.list(); 
</pre>
</div>
<p> ;</p>
<div style="color: #20124d;">Pass an unchecked value from user input to the database will raise security concern, because it can easy get hack by SQL injection. You have to avoid the above bad code and using parameter binding instead.</div>
<h3 style="color: #20124d;">Hibernate parameter binding</h3>
<div style="color: #20124d;">There are two ways to parameter binding :</div>
<ol style="color: #20124d; text-align: left;">
<li>Named parameters binding</li>
<li>Positional parameters binding.</li>
</ol>
<div style="color: #20124d;"> <b>1. Named Parameters Binding: </b></div>
<div style="color: #20124d;">This is the most common and user friendly way. It use colon followed by a parameter name<b> (:example)</b> to define a named parameter. See examples…<b> </b></div>
<h5 style="color: #20124d; font-weight: normal;"><b>Example 1 – setParameter</b></h5>
<div style="color: #20124d;">The <b>setParameter</b> is smart enough to discover the parameter data type for you.</div>
</div>
<pre class="highlight">String hql = "from Student student where student.rollNumber= :rollNumber"; 
Query query = session.createQuery(hql); 
query.setParameter("rollNumber", "3"); 
List result = query.list();</pre>
</div>
<p> ;</p>
<h5>Example 2 – setString</h5>
<p>You can use <b>setString</b> to tell Hibernate this parameter date type is String.</p>
</div>
<pre class="highlight">String hql = "from Student student where student.studentName= :studentName"; 
Query query = session.createQuery(hql); 
query.setString("studentName", "Sweety Rajput"); 
List result = query.list(); 
</pre>
<h5 style="color: #20124d;">Example 3 – setProperties</h5>
<div style="color: #20124d;">This feature is great ! You can pass an object into the parameter binding. Hibernate will automatic check the object’s properties and match with the colon parameter.</div>
</div>
<pre class="highlight">Student student= new Student(); 
student.setCourse("MCA"); 
String hql = "from Student student where student.course= :course"; 
Query query = session.createQuery(hql); 
query .setProperties(student); 
List result = query.list(); 
</pre>
<h4 style="color: #20124d;">2. Positional parameters</h4>
<div style="color: #20124d;">It’s use question mark (?) to define a named parameter, and you have to set your parameter according to the position sequence. See example…</div>
</div>
<pre class="highlight">String hql = "from Student student where student.course= ? and student.studentName = ?"; 
Query query = session.createQuery(hql); 
query.setString(0, "MCA"); 
query.setParameter(1, "Dinesh Rajput") 
List result = query.list(); 
</pre>
<div>
<div style="color: #073763;">In Hibernate parameter binding, i would recommend always go for &#8220;Named parameters&#8221;, as it’s more easy to maintain, and the compiled SQL statement can be reuse (if only bind parameters change) to increase the performance.</div>
<div style="color: #073763;"></div>
<div style="color: #073763;"></div>
<div style="color: #073763;"><b>In the <a href="https://dineshonjava.com/p/named-queries.html">Next Chapter</a> we will discuss about the <a href="https://dineshonjava.com/p/named-queries.html">Named Query</a>.</b></div>
<div style="color: #073763;"><b> </b></div>
<div style="color: #073763;"><b> </b></div>
<div style="color: #073763;"><b> </b></div>
<p><b> <;<;<a style="color: #073763; font-family: Times, 'Times New Roman', serif; font-size: x-large; line-height: 14px;" href="https://dineshonjava.com/p/select-and-pagination-in-hql.html">Previous Chapter 27</a><;<; >;>;N<a style="color: #073763; font-size: x-large; line-height: 14px;" href="https://dineshonjava.com/p/named-queries.html">ext Chapter 29</a>>;>;</b></p>
<div style="color: #073763;"></div>
<div style="color: #073763;"></div>
<div style="color: #073763;"></div>
<div style="color: #073763;"></div>
<div style="color: #073763;"></div>
</div>
</div>

View Comments
Please give example of using alias in HQL
Thanks Farhan. https://dineshonjava.com/introducing-hqlhibernate-query-language/