title: Prevention against SQL Injection in Hibernate
body: <p>I have used hibernate to interact with my database, now I wanted to make my database layer secure against SQL Injection, so I did some research and I found out that my queries should be parameterized , so does it mean if I just structure my HQL queries as:</p>
  
  <pre><code>List mothers = session.createQuery(
  "select mother from Cat as cat join cat.mother as mother where cat.name = ?")
  .setString(0, name)
  .list();
  </code></pre>
  
  <p>Then it's parameterized and protected from SQL Injection, or is there something else which I need to do...</p>
  
  <p>One other thing was mentioned - "<strong><em>Always escape your Data</em></strong>" How can that be achieved ??</p>