HQL is to perform both select and non-select operations on the data, but Criteria is only for selecting the data, we cannot perform non-select operations using criteria HQL is suitable for executing Static Queries, where as Criteria is suitable for executing Dynamic Queries HQL doesn’t support pagination concept, but we can achieve pagination with Criteria Criteria used to take more time to execute then HQL With Criteria we are safe with SQL Injection because of its dynamic query generation but in HQL as your queries are either fixed or parametrized, there is no safe from SQL Injection.

源

HQL和criteriaQuery在性能上是有区别的，每次你使用criteriaQuery发起查询时，它会为表名创建一个新的别名，这个别名不会反映在任何DB的最后一个查询缓存中。这会导致编译生成的SQL的开销，需要更多的时间来执行。

关于抓取策略[http://www.hibernate.org/315.html]

Criteria respects the laziness settings in your mappings and guarantees that what you want loaded is loaded. This means one Criteria query might result in several SQL immediate SELECT statements to fetch the subgraph with all non-lazy mapped associations and collections. If you want to change the "how" and even the "what", use setFetchMode() to enable or disable outer join fetching for a particular collection or association. Criteria queries also completely respect the fetching strategy (join vs select vs subselect). HQL respects the laziness settings in your mappings and guarantees that what you want loaded is loaded. This means one HQL query might result in several SQL immediate SELECT statements to fetch the subgraph with all non-lazy mapped associations and collections. If you want to change the "how" and even the "what", use LEFT JOIN FETCH to enable outer-join fetching for a particular collection or nullable many-to-one or one-to-one association, or JOIN FETCH to enable inner join fetching for a non-nullable many-to-one or one-to-one association. HQL queries do not respect any fetch="join" defined in the mapping document.

当我不知道哪些输入将用于哪些数据时，我通常使用Criteria。就像在一个搜索表单上，用户可以输入1到50个项目中的任何一个，我不知道他们会搜索什么。在检查用户正在搜索的内容时，很容易将更多内容添加到条件中。我认为在这种情况下放置HQL查询会更麻烦一些。当我确切地知道我想要什么时，HQL是很棒的。

还有另一种方法。我最终创建了一个基于hibernate原始语法的HQL解析器，这样它就可以首先解析HQL，然后动态地注入动态参数或自动为HQL查询添加一些通用过滤器。效果很好!

Criteria api提供了一个SQL和HQL都不提供的独特特性。ie。它允许对查询进行编译时检查。

HQL is to perform both select and non-select operations on the data, but Criteria is only for selecting the data, we cannot perform non-select operations using criteria HQL is suitable for executing Static Queries, where as Criteria is suitable for executing Dynamic Queries HQL doesn’t support pagination concept, but we can achieve pagination with Criteria Criteria used to take more time to execute then HQL With Criteria we are safe with SQL Injection because of its dynamic query generation but in HQL as your queries are either fixed or parametrized, there is no safe from SQL Injection.

源