flawopen.com/SQL Injection in C#/NHibernate

Is NHibernate safe from SQL injection?

Reference page — draft, pending review
Short answer

Yes for HQL/Criteria queries with bound parameters. Building an HQL or native SQL string with interpolated values carries the same risk as any other ORM's raw-query path.

UNSAFE
session.CreateQuery(
  $"from User u where u.Id = {userId}")
  .UniqueResult<User>();
SAFE
session.CreateQuery(
  "from User u where u.Id = :id")
  .SetParameter("id", userId)
  .UniqueResult<User>();

The rule

SetParameter() binds the value separately from the HQL text — the same principle as Java's Hibernate (they share the same underlying design), and the same escape-hatch risk pattern seen across every ORM covered so far: the standard API is safe, the string-built raw path is not.

FAQ

Is this the same issue as Java Hibernate?

Yes — NHibernate is a .NET port of Hibernate and shares the identical HQL parameterization model and the identical risk when it's bypassed.

References