Q:

Dynamic amount of parameters in where clause

At the beginning i need to say that the way I trying to do it might be silly but it's only one that I figured it out.
I have table with car properties, one time I need get date by one parameter
{
  "mark": "Audi"
}
other time i need more specific
{
  "mark": "Audi",
  "model":"A4"
} 
So I write method 
    public List<Object> findVehicleProperty(String propertyType, Vehicle vehicle) {
    String queryParam = "";

    if(vehicle.getMark() != null) queryParam += "mark='"+vehicle.getMark()+"'&";
    if(vehicle.getModel() != null) queryParam += "model='"+vehicle.getModel()+"'&";
    if(vehicle.getEnginePower() != null) queryParam += "engine_power="+vehicle.getEnginePower()+"&";
    if(vehicle.getSeatCount() != null) queryParam += "seat_count="+vehicle.getSeatCount()+"&";
    if(vehicle.getDoorsCount() != null) queryParam += "doors_count="+vehicle.getDoorsCount()+"&";
    if(vehicle.getGearboxCount() != null) queryParam += "gearbox_count="+vehicle.getGearboxCount()+"&";
    if(vehicle.getType() != null) queryParam += "type="+vehicle.getType()+"&";

    //remove last "&" mark
    if (queryParam.length() > 0) {
        queryParam = queryParam.substring(0, queryParam.length() - 1);
    }

    return vehicleRepository.getParameters(queryParam);
}

which return WHERE clause from sql "mark=Audi&model=A4, then I tryed to pass this part of sql as parametrer to Repository 
@Query(value = "select * from Vehicle where ?1", nativeQuery = true)
List<Object> getParameters(String query);

I console I can see that it interpate kind of well 
2018-10-29 21:35:57.488 DEBUG 6240 --- [nio-8080-exec-1] org.hibernate.SQL                        : select * from Vehicle where ?

2018-10-29 21:35:57.494 TRACE 6240 --- [nio-8080-exec-1] o.h.type.descriptor.sql.BasicBinder      : binding parameter [1] as [VARCHAR] - [mark='Audi'&model='A4']

but this request always return empty collection, if I use select * from Vehicle where mark='Audi'&model='A4' directly on DB I get correct results. 
Have You any idea why ?

A:

You cannot use prepared statements to "inject" whole where clause as it will escape your "native string" so you will end up with 
SELECT * FROM whatever WHERE '123456'

or something similar.
For dynamic Criterias (that is your case) use CriteriaAPI  so CriteriaBuilder will be your friend here.

