HQL可能会导致SQL注入等安全问题。

Criteria Api是Hibernate的一个很好的概念。根据我的观点，这些是我们可以区分HQL和Criteria Api的少数点

HQL is to perform both select and non-select operations on the data, but Criteria is only for selecting the data, we cannot perform non-select operations using criteria. HQL is suitable for executing Static Queries, where as Criteria is suitable for executing Dynamic Queries HQL doesn’t support pagination concept, but we can achieve pagination with Criteria. Criteria used to take more time to execute than HQL. With Criteria we are safe with SQL Injection because of its dynamic query generation but in HQL as your queries are either fixed or parametrized, there is no safe from SQL Injection

对于动态条件查询，我们可以根据我们的输入构造查询..在Hql查询是静态查询的情况下，一旦我们构造，我们就不能改变查询的结构。

这里的大多数答案都是误导性的，并提到标准查询比HQL慢，但事实并非如此。

如果你深入研究并执行一些测试，你会发现标准查询比常规HQL执行得更好。

同样，通过Criteria Query，你可以得到HQL所没有的面向对象的控制。

更多信息请阅读这里的答案。

HQL更容易阅读，更容易使用Eclipse Hibernate插件等工具进行调试，也更容易记录日志。条件查询更适合构建动态查询，其中许多行为都是在运行时确定的。如果你不知道SQL，我可以理解使用Criteria查询，但总的来说，如果我知道我想要什么，我更喜欢HQL。

Criteria是一个面向对象的API，而HQL意味着字符串连接。这意味着面向对象的所有好处都适用:

All else being equal, the OO version is somewhat less prone to error. Any old string could get appended into the HQL query, whereas only valid Criteria objects can make it into a Criteria tree. Effectively, the Criteria classes are more constrained. With auto-complete, the OO is more discoverable (and thus easier to use, for me at least). You don't necessarily need to remember which parts of the query go where; the IDE can help you You also don't need to remember the particulars of the syntax (like which symbols go where). All you need to know is how to call methods and create objects.

由于HQL非常像SQL(大多数开发人员已经非常了解SQL)，因此这些“不必记住”参数就没有那么重要了。如果HQL有更大的不同，那么这就更重要了。