title: Is the @Query annotation in spring SQL Injection safe?
body: <p>Do the parameters of a string passed to the @Query annotation, for Spring, get treated as pure data as they would if, for example, you were using the PreparedStatement class or any method meant to prevent SQL injection?</p>
  
  <pre><code>final String MY_QUERY = "SELECT * FROM some_table WHERE some_column = ?1";
  
  @Query(value=MY_QUERY, nativeQuery = true)
  List&lt;SomeEntity&gt; findResults(String potentiallyMaliciousUserInput);
  </code></pre>
  
  <p><strong>Bottom Line:</strong> Is the code above susceptible to SQL injection?</p>