| | 127 | === SQL injection prevention |
| | 128 | {{{ |
| | 129 | @Query(value = """ |
| | 130 | SELECT * |
| | 131 | FROM get_top_active_users(:startTs, :endTs) |
| | 132 | """, nativeQuery = true) |
| | 133 | List<UserActivityRankingProjection> getTopActiveUsers( |
| | 134 | @Param("startTs") LocalDateTime startTs, |
| | 135 | @Param("endTs") LocalDateTime endTs |
| | 136 | ); |
| | 137 | }}} |
| | 138 | * Native queries are executed using named parameters such as :startTs and :endTs, which are bound by Spring Data JPA. This prevents SQL injection because input values are treated as parameters, not as executable SQL. |
| | 139 | |
