WebApp Sec: Hibernate Query Language

[alfredhitchcock_007 () yahoo com]

Hi All,

I am being tasked to do a comprehensive security audit for a java application. This java application is using Hibernate 
Query Language (HQL). Does anybody have an idea about vulnerable API's in HQL? How do I find out vulnerable SQL 
constructs in this language? 

I am thorough with SQL Injection where Dynamic queries and normal stored procedures are being used. But HQL uses 
different API's to construct the SQL query. Can anybody help me in identifying potential issues with HQL?