Prevent HQL Injection Via Named Parameter

  
hibernateTemplate.find("from User where username ='" + name + "'");
hibernateTemplate.findByNamedParam("from User where username=:userName", "userName" , name);

Both statements will return the same result. The difference is the 2nd statement is immune to HQL injection while the 1st one is not.
This is easily verified by using the well-known injection code ' or '1'='1
Addtional testing using other injection codes would be better to get some confidence.
 Reference : https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet