Hibernate doesn't treat backslashes correctly --> sql injection.

Hibernate is supposed to protect us from injection of raw sql through it's hql setup but it fails to handle the following correctly:
$xwiki.searchDocuments("''='\''; drop table xwikidoc; --\'")

I think we need to escape backslashes before running queries with hibernate until they get this issue sorted out.