Question

I want to find all Users whose email contain the string middle somewhere inside.

The following code fails – it seems JPA doesn’t recognize the ? as a parameter because its enclosed by quotation marks.

List<User> users = User.findAll("email like '%?%'", middle);

The following code works, but is open to SQL injections:

List<User> users = User.findAll("email like '%" + middle + "%'");

What would you suggest?

Answer 1

Try moving your string manipulation to the Java side, and keep the SQL parameter:

List<User> users = User.findAll("email like ?", "%"+middle+"%");