Question

For eg. i have:

Input:
ArrayList<Integer> idlist
String nameText

    String q = "DELETE FROM myTable AS a WHERE a.name LIKE '%' || :name || '%' OR a.id IN (:idlist)";

    Query query = entityManager.createQuery(q);
    query.setParameter("name", nameText);
    query.setParameter("idlist", idlist);

query.executeUpdate();

Would the above snippet of code susceptible to sql injections?
I have one more question is there a diffrence between the way above query is built and if we form query by criterias:

CriteriaBuilder cb = em.getCriteriaBuilder();

  CriteriaQuery<Country> q = cb.createQuery(Country.class);
  Root<Country> c = q.from(Country.class);
  q.select(c);

Is there any advantage of one over another?

Answer 1

No, it wouldn’t. That’s the whole point of parameterized queries.