Prevention of SOQL Injection

Hello Avnish,

There are a number of techniques you can use to prevent SOQL injection:

1. Static queries with bind variables
2. String.escapeSingleQuotes()
3. Type casting
4. Replacing characters
5. Whitelisting

for elobraton you can check following link: https://trailhead.salesforce.com/en/modules/secdev_injection_vulnerabilities/units/secdev_inject_prevent_soql_injection

• This reply was modified 6 years, 3 months ago by  chanchal kumar.

Hi

The first and most recommended method to prevent SOQL injection is to use static queries with bind variables. Consider the following query.

String query = ‘select id from contact where firstname =\’’+var+’\’’;
queryResult = Database.execute(query);

Copy
As you’ve learned, using user input (the var variable) directly in a SOQL query opens the application up to SOQL injection. To mitigate the risk, translate the query into a static query like this one.

queryResult = [select id from contact where firstname =:var];

Copy
This ensures that the user input is treated as a variable, not as an executable element of the query. If a user types a value like test’ LIMIT 1 when the database performs the query, it looks for any first names that are “test’ LIMIT 1” in the database. With a bind variable, the attacker isn’t able to break out and control the SOQL query.

While using bind variables is recommended, there are some limitations. They can only be used in these types of clauses.

The search string in FIND clauses.
The filter literals in WHERE clauses.
The value of the IN or NOT IN operator in WHERE clauses, enabling filtering on a dynamic set of values. Note that this is of particular use with a list of IDs or strings, though it works with lists of any type.
The division names in WITH DIVISION clauses.
The numeric value in LIMIT clauses.
The numeric value in OFFSET clauses.

Thanks