HQL可能会导致SQL注入等安全问题。

我不想在这里白费口舌，但有一点很重要，那就是Criteria查询现在已被弃用。使用HQL。

对于动态查询，我也更喜欢使用条件查询。但我更喜欢hql删除查询，例如，如果从父id 'xyz'的子表中删除所有记录，这很容易由hql实现，但对于标准API，首先我们必须触发n个删除查询，其中n是子表记录的数量。

Criteria是一个面向对象的API，而HQL意味着字符串连接。这意味着面向对象的所有好处都适用:

All else being equal, the OO version is somewhat less prone to error. Any old string could get appended into the HQL query, whereas only valid Criteria objects can make it into a Criteria tree. Effectively, the Criteria classes are more constrained. With auto-complete, the OO is more discoverable (and thus easier to use, for me at least). You don't necessarily need to remember which parts of the query go where; the IDE can help you You also don't need to remember the particulars of the syntax (like which symbols go where). All you need to know is how to call methods and create objects.

由于HQL非常像SQL(大多数开发人员已经非常了解SQL)，因此这些“不必记住”参数就没有那么重要了。如果HQL有更大的不同，那么这就更重要了。

为了两全其美，HQL的表达性和简洁性以及Criteria的动态特性可以考虑使用Querydsl。

Querydsl支持JPA/Hibernate, JDO, SQL和Collections。

我是Querydsl的维护者，所以这个答案是有偏见的。

We used mainly Criteria in our application in the beginning but after it was replaced with HQL due to the performance issues. Mainly we are using very complex queries with several joins which leads to multiple queries in Criteria but is very optimized in HQL. The case is that we use just several propeties on specific object and not complete objects. With Criteria the problem was also string concatenation. Let say if you need to display name and surname of the user in HQL it is quite easy (name || ' ' || surname) but in Crteria this is not possible. To overcome this we used ResultTransormers, where there were methods where such concatenation was implemented for needed result. Today we mainly use HQL like this:

String hql = "select " +
            "c.uuid as uuid," +
            "c.name as name," +
            "c.objective as objective," +
            "c.startDate as startDate," +
            "c.endDate as endDate," +
            "c.description as description," +
            "s.status as status," +
            "t.type as type " +
            "from " + Campaign.class.getName() + " c " +
            "left join c.type t " +
            "left join c.status s";

Query query =  hibernateTemplate.getSessionFactory().getCurrentSession().getSession(EntityMode.MAP).createQuery(hql);
query.setResultTransformer(Transformers.ALIAS_TO_ENTITY_MAP);
return query.list();

因此，在本例中，返回的记录是所需属性的映射。