How does building an sql query in java using query builder help prevent sql injection?

Because Query Builder defines parameterised queries so that it verify the input string by the user. And do not let the user to enter malicious data in input parameter.

Note: Parametering of input variables in query is the v basic level of stoping SQL injections. to proper blocking Please use Store Procedures.

SQL allows expressions in almost every clause and position the Doctrine 

QueryBuilder can only prevent SQL injections for calls to the methods setFirstResult() and setMaxResults().

All other methods cannot distinguish between user- and developer input and are therefore subject to the possibility of SQL injection.

To safely work with the QueryBuilder you should NEVER pass user input to any of the methods of the QueryBuilder and use the placeholder ? or :name syntax in combination with $queryBuilder->setParameter($placeholder, $value) instead: