Potential DoS attack using Login or Search forms

Reported by Pablo Oliveira:

It's possible for a user to modify the HQL that gets executed (in the Login form or in Search forms for example). For example, it's possible, in the login form type the following instead of the user name:

\'  )   AND 5=BENCHMARK(1000000000,MD5(CHAR(116)))  --  

This example will keep the SQL server busy for a long time...