Hello,

Plain-vanilla NHibernate setup, eg, no fluent NHibernate, no HQL, nothing except domain objects and NHibernate mapping files. I load objects via:

_lightSabers = session.CreateCriteria(typeof(LightSaber)).List<LightSaber>();

I apply raw user input directly to one property on the "LightSaber" class:

myLightSaber.NameTag = "Raw malicious text from user";

I then save the LightSaber:

session.SaveOrUpdate(myLightSaber);

Everything I've seen says that yes, under this situation you are immune to SQL injection, because of the way NHibernate parameterizes and escapes the queries under the hood. However, I'm also a relative NHibernate beginner so I wanted to double-check. *waves hand* these aren't the droids you're looking for.

Thanks!