title: Is this JPA query vulnerable to SQL injection?
body: <p>I have a library that executes a query based on a JPA WHERE statement provided by a caller. I am executing the following JPA query:</p>
  
  <pre><code>public void executeQuery(String jpaWhereStatement) {
  String queryString = "SELECT entity FROM " + MyEntity.class.getSimpleName() + " entity WHERE " + jpaWhereStatement;
  }
  </code></pre>
  
  <p>The query parameters are still inserted using <code>query.setParameter()</code>, but I am worried I might be allowing a SQL injection attack. If this is vulnerable, how can I fix this code?</p>