title: How to prevent SQL Injection with JPA and Hibernate?
body: <p>I am developing an application using hibernate. When I try to create a Login page, The problem of Sql Injection arises.
   I have the following code:</p>
  
  <pre><code>@Component
  @Transactional(propagation = Propagation.SUPPORTS)
  public class LoginInfoDAOImpl implements LoginInfoDAO{
  
  @Autowired
  private SessionFactory sessionFactory;      
  @Override
  public LoginInfo getLoginInfo(String userName,String password){
      List&lt;LoginInfo&gt; loginList = sessionFactory.getCurrentSession().createQuery("from LoginInfo where userName='"+userName+"' and password='"+password+"'").list();
      if(loginList!=null )
          return loginList.get(0);
      else return null;   
            }
        }
  </code></pre>
  
  <p>How will i prevent Sql Injection in this scenario ?The create table syntax of loginInfo table is as follows:</p>
  
  <pre><code>create table login_info
    (user_name varchar(16) not null primary key,
    pass_word varchar(16) not null); 
  </code></pre>