Are SQL injection attacks possible in JPA?

Question

I'm building a Java Web Application using Java EE 6 and JSF-2.0, using the persistence API for all database operations.

The back-end is MySQL, but I have used the EntityManager functions and Named Queries in EJB-QL for all operations. Are SQL injection attacks possible in this case?

Answer 1

Yes, it is possible. It depends on the way you implement.
Have a look at Preventing injection in JPA query language.

Answer 2

It's only possible if you're inlining user-controlled variables in a SQL/JPQL string like so:

String sql = "SELECT u FROM User u WHERE id=" + id;

If you aren't doing that and are using parameterized/named queries only, then you're safe.

Answer 3

If your JPA provider processes all input arguments to handle injection attacks then you should be covered. We do thin in EclipseLink.

As the previous poster mentioned piecing together your own JPQL or SQL (for native queries) could expose you.

I would recommend using named queries with parameters over concatenating strings to build JPQL/SQL.

Doug