[Demonstration 1]

[Buggy Method]
@Override
public void delete(final Collection<ProductEntry> productsToDelete) throws Exception {
    final List<String> ids = new ArrayList<>();
    for (ProductEntry productEntry : productsToDelete) ids.add(productEntry.id);
    execute(new Update() {

        @Override
        public void execute(Session session) {
            session.createSQLQuery("DELETE FROM product_entry  WHERE product_entry.id IN (:values)").setParameter("values", ids).executeUpdate();
        }
    });
}

[Buggy Hunk]
.setParameter("values", ids ).executeUpdate();

[Patch]
.setParameterList("values", ids ).executeUpdate();

[Demonstration 2]

[Buggy Method]
public static void createAnnouncement(String announcement) throws SQLException {
    announcement = StringUtils.escapeQuote(announcement, "'");
    Statement s = SQL.getStatement();
    s.executeUpdate(String.format("INSERT INTO Announcements VALUES ('%s', %s)", announcement, SQL.convertDateToSQLDate(new Date())));
    s.close();
}

[Buggy Hunk]
announcement = StringUtils.escapeQuote(announcement, "'");

[Patch]
announcement = SQL.escapeQuote(announcement);