jdbc - Prepared statements, hibernate and HQL -

hibernate internally uses preparedstatements under jdbc when converting hql sql. how inline parameters within hql handled ?

example:

  public list<student> loadallstudentsbystatus(string status) {     string querystring = "from student student student.status = " + status;     query queryobject = currentsession().createquery(querystring);     return queryobject.list();   } 

will status "parsed" , used parameter in sql, or sent inline parameter.

my reason behind argument "best practices", , query performance repetitive calls

it gets sent inline. don't want when status client-controlled value.

rather parameterize it:

return currentsession()     .createquery("from student student student.status = :status")     .setparameter("status", status)     .list(); 

see also:

• owasp - hibernate