Question

I have a criteria query that uses some params entered by the user, such as:

def query = MyTable.createCriteria()
def myQueryResult = query.list() {
   if (params.minToInvestMin)
                ge('minimalToInvest', params.minToInvestMin.toBigDecimal())
   if (params.minToInvestMax)
                le('minimalToInvest', params.minToInvestMax.toBigDecimal())
}

I have read the Grails doc on the subject as well as some other articles, but it only speaks about HQL way to avoid SQL injections.

Does criteria uses HQL in the backscene?
Or more directly, is this type of criteria query safe to SQL injections?

I am fairly new to security matters.

Answer 1

Yes, the criteria statements in your example are safe from injection.

Criteria statements are just a convenient builder for Hibernate’s Criteria API, so any query you construct with it is afforded all of the same behavior.