Usually I've seen people keeping them in hibernate xml with named queries, or some proprietrary .xml files.
CDATA is overkill IMHO, easier to escape the few problematic characters.
Remember, SQL statements are source code.
Reply on news.ycombinator.com