Are SQL injection attacks possible in JPA?

It’s only possible if you’re inlining user-controlled variables in a SQL/JPQL string like so:

String sql = "SELECT u FROM User u WHERE id=" + id;

If you aren’t doing that and are using parameterized/named queries only, then you’re safe.