title: Hibernate : How to prevent SQL injection when the collection elements needs to check with `like` operator?
body: <p>I am having a <code>query</code> something like this.</p>
  
  <pre><code>StringBuilder sbQry = new StringBuilder();
  sbQry.append("select * from tableName where 1=1");
  if(!myCollection.isEmpty()){
      sbQry.append("  and (");
          for (int i = 0; i &lt; myCollection.size(); i++) {
              final String module = myCollection.get(i);
              sbQry.append("column = '" + module
                      + "' or column like 'J_'||'"
                      + module.replaceAll("-", "%") + "'");
              if (!(i == (myCollection.size() - 1))) {
                  sbQry.append(" or ");
              }
          }
          sbQry.append(") ");
   }
  </code></pre>
  
  <p><strong>Here this query <code>sbQry</code> is vulnerable to <code>SQLInjection</code> because of <code>myCollection</code> is coming from the external source.</strong></p>
  
  <p>In case my collection elements would be comparing based on <code>=</code> operator then I use prepared statement, something like:</p>
  
  <pre><code>sbQry.append(column in (:collection));
  Query query = session.createSQLQuery(sbQry.toString());
  query.setParameterList("collection",myCollection);
  </code></pre>
  
  <p>Could anyone please suggest me how can I prevent the SQL injection in this case.</p>
  
  <p>Any help will be appreciated.</p>