Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way through the .net framework or some other package to sanitize strings so that they can be safely used in sosl? Is there any larger standard that SOSL falls under?

I was able to find How to pass a variable to the SOQL where clause? and Escaping reserverved characters in SOSL queries, but they both deal with solving specific cases rather than a general solution.

I would prefer not to roll my own solution.

share|improve this question
up vote 4 down vote accepted

From Dynamic SOSL - SOSL Injection:

SOSL injection is a technique by which a user causes your application to execute database methods you did not intend by passing SOSL statements into your code. This can occur in Apex code whenever your application relies on end user input to construct a dynamic SOSL statement and you do not handle the input properly.

To prevent SOSL injection, use the escapeSingleQuotes method. This method adds the escape character (\) to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands.

Based on that is should be sufficient to escape any single quote characters in the user based input before merging it with your dynamic SOSL.

share|improve this answer
Is the escapeSingleQuotes method only available in the apex language? – Ryan Gates Apr 16 '14 at 14:19
That particular method is apex specific. In C# you would do something like s = s.Replace("'", @"\'"); – Daniel Ballinger Apr 16 '14 at 19:19
Yeah, that is what I'm doing now, but I would like to have it be more inclusive as technically the special characters go beyond ', without writing my own library. – Ryan Gates Apr 16 '14 at 19:23
I don't know of a library that includes such a function for C#. You might find something in the Salesforce Toolkits for .NET. Now I want to send the Bell character in to see I can make noises on the Salesforce servers. – Daniel Ballinger Apr 16 '14 at 20:02
I know, I couldn't believe the bell was in there, along with form feed. – Ryan Gates Apr 16 '14 at 21:28

These links should give you some good information on Injection.. For the most part I don't believe Salesforce has the same security risks because it doesn't use SQL, which does induce some limitations, while adding some security as a bi-product.

Also check into the security scanner, personally I haven't used it but it may assist you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.