Chaining setParameter on Hibernate Query

问题

As you can see I have two named parameters, one being set by setParameterList() and one being set by setParmeter(). The problem is the List is not being ordered. When I set the order field explicitly it works fine, but the same string is being passed into the method it doesn't work. Is it that setParameter and and setParameterList can't be chained? They both return a query do I don't see why not. What am I missing?

public List<Subject> getSubjectsByMedium(String orda, Medium... medium) {
    List<Subject> subjects = currentSession().createQuery("from Subject where medium in(:medium) order by :orda").setParameterList("medium", medium).setParameter("orda", orda).list();
    return Subjects;
}

回答1:

No, it's not a problem of method chaining. The problem is you can't use named parameters to set the ORDER in an HQL (or SQL) query.

You'll need to build the query String separately and then set the :medium named parameter on the created Query object.

String query = "from Subject where medium in(:medium) order by " + orda;

This does possibly leave you vulnerable to SQL injection.

来源：https://stackoverflow.com/questions/18898315/chaining-setparameter-on-hibernate-query