Does Hibernate's createCriteria() sanitize input?

Question

Came across some code today that uses Hibernate to perform a query. The query uses a value submitted from a form. It made me curious as to whether or not this sort of code "sanitizes" its input.

public List<School> search(String query) {
    Session session = this.getCurrentSession();
    query = "%" + query + "%";
    Criteria criteria = session.createCriteria(getPersistentClass());
    criteria.createAlias("country", "a");
    Criterion nameCriterion = Restrictions.ilike("name", query);
    Criterion cityCriterion = Restrictions.ilike("city", query);
    Criterion countryCriterion = Restrictions.ilike("a.name", query);
    Criterion criterion = Restrictions.or(Restrictions.or(nameCriterion, cityCriterion), countryCriterion);
    criteria.add(criterion);
    return criteria.list();
}

Is this safe?

Answer 1

Hibernate Criteria Queries are quiet safe in terms of Sql Injection since they pass strings as parameter while performing any fetch. Even, Hql is quiet safe unless you build the query via string literal.

For more details, you should take a look at queries getting fired at the database level by switching on hibernate sql logging.