title: Does the Java/Hibernate Criteria Query API Protect Against Injection?
body: <p>This might be a dumb question, but I have not seen anything in the docs explicitly stating that criteria queries are parameterized or otherwise injection-protected under the hood.</p>
  
  <p>In other words, is a predicate like the following directly vulnerable to injection attacks? If so, how do I fix it? Looking around the docs I don't see any options for parameterization or anything similar.</p>
  
  <pre><code>criteriaBuilder.like(
      root.get("prop"),
      "%"+userInput+"%"
  )
  </code></pre>