title: How to prevent SQL injection in native insert query with JPA?
body: <p>I'm using a native query with JPA / Hibernate to perform an insert or update ("upsert") on PostgreSQL, depending whether an object exists or not. The code looks like this:</p>
  
  <pre><code>val values: String = items.joinToString(", ", transform = this::convertItemToSqlValue)
  val query = """
      insert into item (field1, field2)
      values $values
      on conflict on constraint item_pkey
      do update set 
          field1 = excluded.field1,
          field2 = excluded.field2
  """
  entityManager.createNativeQuery(query).executeUpdate()
  </code></pre>
  
  <p>The function <code>convertItemToSqlValue</code> creates a String of the form <code>('value a', 123)</code>.</p>
  
  <p>A positional parameter (<code>values ?</code>) didn't work (and led to a syntax error).</p>
  
  <p>How could I prevent SQL injection with this kind of statmentement?</p>