Use Bind Parameters in Hibernate Queries

ID

java.hibernate_bind_parameters_in_queries

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

CWE:89, hibernate, orm, reliability, sql

Description

Reports calls to createQuery, createNativeQuery, createNamedQuery, or createSQLQuery where the first argument is a string-concatenation expression containing non-literal operands. Building queries with string concatenation bypasses the query plan cache, introduces SQL/HQL injection risk, and loses type safety.

Rationale

When a query string is assembled via + with variables, every invocation produces a different query string, preventing the JPA provider from caching the parsed query plan. More critically, unsanitized input can alter the query’s semantics.

// Bad: string concatenation in query
em.createQuery("SELECT u FROM User u WHERE u.name = '" + name + "'");

// Bad: native query with concatenated table name
em.createNativeQuery("SELECT * FROM " + table);

Remediation

Use positional or named bind parameters and setParameter():

// Good: bind parameter
em.createQuery("SELECT u FROM User u WHERE u.name = :name")
  .setParameter("name", name);

// Good: native query with bind parameter
em.createNativeQuery("SELECT * FROM users WHERE id = ?1")
  .setParameter(1, id);

References