java - setParameter For Two Or More Arguments Not Working In Jpa (Mysql Injection) -

hello guys...i looking way avoid mysql injection in jpa..and got link http://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-persistence-api-jpa cool...and works fine single argument here code...

            stringbuilder getcity = new stringbuilder();             getcity.append("select ");             getcity.append(" city.* ");             getcity.append("from  ");             getcity.append(" city  ");             getcity.append("where ");             getcity.append("city.name ?1");             system.out.println(getcity.tostring());             getsearchquery=entitymanager.createnativequery(getcity.tostring(),citymodel.class).setmaxresults(1);             getsearchquery.setparameter(1,querytosearch);             city=(citymodel)getsearchquery.getsingleresult(); 

here other code 2 argument there..

getcity.append("select ");             getcity.append(" concat_ws('<br />',city.name,city.address) ");             getcity.append("from  ");             getcity.append("city  ");             getcity.append("where ");             getcity.append(" (city.name ");             getcity.append(" ?1 or city.address ");             getcity.append(" ?2)");             getcity.append(" , ");             getcity.append(" city.status=");             getcity.append("'"+"active"+"'");             getcity.append(" , city.type= ?3");             system.out.println(getcity.tostring());             getsearchquery=entitymanager.createnativequery(getcity.tostring());             getsearchquery.setparameter(1,querytosearch);             getsearchquery.setparameter(2,querytosearch);             getsearchquery.setparameter(3,citytype); 

note:works fine in second query if put 1 like...(multiple , argument not working) , curious how ?1 in query works %type% or %type or type :)

for future users wants in jpa native query

wrong one...

 getsearchquery.setparameter(1,querytosearch);  getsearchquery.setparameter(2,querytosearch);  getsearchquery.setparameter(3,citytype); 

right one

 getsearchquery.setparameter(1,"%"+querytosearch+"%");  getsearchquery.setparameter(2,"%"+querytosearch+"%");  getsearchquery.setparameter(3,citytype);