Summary
When a mapped class or property name is a keyword in the underlying database (like "user" for SQL Server) the mapping should be escaped with backticks: name="`USER`".
In the SQL generated by Hibernate the properties are then escaped by default with ", or by the characters specified in the configured Dialect.
Pitfalls
Note that the moment a property is escaped it becomes case sensitive in case sensitive databases like HSQL. For HSQL the escaped properties need to be uppercase to be interpreted properly.