How to prevent SQL Injection with JPA and Hibernate?
Query q = sessionFactory.getCurrentSession().createQuery(“from LoginInfo where userName = :name”); q.setParameter(“name”, userName); List<LoginInfo> loginList = q.list(); You have other options too, see this nice article from mkyong.