I'm not sure how to tell JPA to (not) use a prepared statement.
You can't. It depends on the provider you use and if/how it exposes this kind of configuration.
Is JPA automatically using prepared statments for this?
Any decent provider will use prepared statments.
What about criteria API. My guess is that it's using dynamic sql?
Same as above. In example, Hibernate uses prepared statments even with native queries:
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2113)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2568)
at com.mysql.jdbc.PreparedStatement.executeInternal(PreparedStatement.java:2113)
at com.mysql.jdbc.PreparedStatement.executeQuery(PreparedStatement.java:2275)
at org.hibernate.jdbc.AbstractBatcher.getResultSet(AbstractBatcher.java:186)
at org.hibernate.loader.Loader.getResultSet(Loader.java:1787)
at org.hibernate.loader.Loader.doQuery(Loader.java:674)
at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:236)
at org.hibernate.loader.Loader.doList(Loader.java:2220)
(credit OO7)