Correct way to handle the session in hibernate

Question

My code works, I just want to know if it's well written and what I should modify. I used different method to do MySQL selects, with hibernate HQL and with Criteria. Mainly to learn to use them. Another question is about Hibernate session, I don't know if I'm using it in the proper way.

I've this session creation class:

public class HibernateUtil {

    private static final SessionFactory sessionFactory = buildSessionFactory();

    private static SessionFactory buildSessionFactory() {
        try {               
            //VER HIB 4
            Configuration configuration = new Configuration().configure();
            StandardServiceRegistryBuilder builder = new StandardServiceRegistryBuilder().
            applySettings(configuration.getProperties());

            SessionFactory sf = configuration.buildSessionFactory(builder.build());

            return sf;          
        }
        catch (Throwable ex) {
            // Make sure you log the exception, as it might be swallowed
            System.err.println("Initial SessionFactory creation failed." + ex);
            throw new ExceptionInInitializerError(ex);
        }
    }

    public static SessionFactory getSessionFactory() {
        return sessionFactory;
    }

}

And I've created a DAO class:

public class CreazioneUtenzaDAO extends CommonDAO
{

    public CreazioneUtenzaDAO() {

    }

    public List<Comune> getComuni()
    {
        Session session = HibernateUtil.getSessionFactory().getCurrentSession();
        session.beginTransaction();
        List<Comune> com = session.createQuery("FROM Comune").list(); 
        session.getTransaction().commit();

        return com;
    }

    public List<Ente> getEntiFromComune(Comune comune) {
        SessionFactory sf = HibernateUtil.getSessionFactory();
        Session session = sf.openSession();
        Criteria cri = session.createCriteria(Ente.class, "ente");
        //join on ente.tipoufficios as tipouff
        cri.createAlias("ente.tipoufficios", "tipouff");
        cri.createAlias("tipouff.ufficios", "uff");
        cri.add(Restrictions.eq("uff.comune", comune));
        cri.setResultTransformer(Criteria.DISTINCT_ROOT_ENTITY);        
        List <Ente> en = cri.list();
        session.close();

        return en;
    }

    public List<Tipoufficio> getTipoufficioFromComuneEnte(String idComune, String idEnte) 
    {
        String strSql ="SELECT DISTINCT tu "+
                "FROM Tipoufficio tu INNER JOIN tu.ufficios as u "+ 
                "WHERE u.comune.codComune= :idComune AND tu.ente.idEnte= :idEnte "
                +"order by tu.descrizione";

        Session session = HibernateUtil.getSessionFactory().getCurrentSession();
        session.beginTransaction();
        Query query = session.createQuery(strSql);
        query.setParameter("idComune", idComune);
        query.setParameter("idEnte", idEnte);

        List<Tipoufficio> list = query.list();
        session.close();
        return list;
    }

    public List<Ufficio> getUfficiFromComuneEnteTipoufficio(String idComune,
            String idEnte, String codTipoUfficio) {
        String strSql ="SELECT DISTINCT u  "+
                "FROM Ufficio as u INNER JOIN u.tipoufficio as tu "+ 
                "WHERE u.comune.codComune= :idComune AND tu.ente.idEnte= :idEnte AND tu.idTipoUfficio= :codTipoUfficio "
                +" order by u.descrizione ";

        Session session = HibernateUtil.getSessionFactory().getCurrentSession();
        session.beginTransaction();
        Query query = session.createQuery(strSql);
        query.setParameter("idComune", idComune);
        query.setParameter("idEnte", idEnte);
        query.setParameter("codTipoUfficio", codTipoUfficio);
        List<Ufficio> list = query.list();
        session.close();
        return list;
    }

    public List<Email> getEmails() 
    {
        Session session = HibernateUtil.getSessionFactory().getCurrentSession();
        session.beginTransaction();
        List<Email> tmp = session.createQuery("FROM Email").list();         
        session.getTransaction().commit();
        return tmp;
    }

    public List<Applicazione> getApplicazioni() 
    {
        return selectAll("Applicazione");
    }

    public List<Qualifica> getQualifiche() {
        return selectAll("Qualifica");
    }
}

Are the way in which I open, close, begin and commit the transaction right? Or I should for example open and close the session just on time? Which is the best practice?

Answer 1

Recommend that you look at using Spring with Hibernate. It automates a lot of the session handling tasks.

http://docs.spring.io/spring/docs/current/spring-framework-reference/html/orm.html

For an example using this approach:

http://examples.javacodegeeks.com/enterprise-java/spring/jpaorm/spring-hibernate-mysql-and-maven-showcase/

Answer 2

 u.comune.codComune='"+idComune+"'

this is just asking for sql injection. use .setParameter to avoid this.