Are SQL injection attacks possible in JPA?

I'm building a Java Web Application using Java EE 6 and JSF-2.0, using the persistence API for all database operations.

The back-end is MySQL, but I have used the EntityManager functions and Named Queries in EJB-QL for all operations. Are SQL injection attacks possible in this case?

It's only possible if you're inlining user-controlled variables in a SQL/JPQL string like so:

String sql = "SELECT u FROM User u WHERE id=" + id;

If you aren't doing that and are using parameterized/named queries only, then you're safe.

Yes, it is possible. It depends on the way you implement.
Have a look at Preventing injection in JPA query language.

If your JPA provider processes all input arguments to handle injection attacks then you should be covered. We do thin in EclipseLink.

As the previous poster mentioned piecing together your own JPQL or SQL (for native queries) could expose you.

I would recommend using named queries with parameters over concatenating strings to build JPQL/SQL.

Doug