title: Prevent JPQL query sql injection
body: <p>I was advised that below query is not safe as parameter <strong>:searchFor</strong> coming from input field in front end can be used for SQL injection.
  Plase advise what is the best solution to prevent SQL injection in below code?</p>
  
  <pre><code>@Query("SELECT u FROM User u WHERE lower(u.username) LIKE %:searchFor% " +
          " OR lower(concat(u.firstname, ' ', u.lastname)) LIKE %:searchFor% " +
          " OR lower(u.email) LIKE %:searchFor%")
  Page&lt;User&gt; findAllAndSearch(@Param(value = "searchFor") String searchFor, Pageable pageable);
  </code></pre>
  
  <p>I am not using "+" to join strings, but provide parameter instead (:searchFor). Not sure if this still unsafe.</p>