title: SQL binding mechanisms should be used
body: <p>I have a code as following :</p>
  
  <pre><code>final String query = "SELECT id FROM " + getSimpleName() + " WHERE " + relationName + ".id = :successor";
  final Query queryConcerned = this.entityManager.createQuery(query);
  query.setParameter("successor", successorId);
  </code></pre>
  
  <p>But Sonar gives the following warning :</p>
  
  <blockquote>
    <p>Use a variable binding mechanism to construct this query instead of
    concatenation.</p>
  </blockquote>
  
  <p>As you can see the values I'm concatenating are not parameters, in doing so, am I vulnerable to SQL injections, if so, how can I solve this ?</p>