What's the problem with this backslash in SOQL query?

Question

I'm receiving a String query with query params (via URL), and one is mandatory and seven are optional. So if i don't receive a param, shouldn't be included in the query.

For instance:

My code is:

List<customObject__c> lstCstObj = [SELECT customField1__c, customField2__c, customField3__c, customField4__c, customField5__c FROM customObject__c WHERE customField2__c =: strVar1 + strCondition];

The value of strVar1 is the result of:

String.valueOf(RestContext.request.params.get('name'));

The value of strSurname is:

String strSurname = String.valueOf(RestContext.request.params.get('surname'));

And that give us the value of The value of strCondition (here is the problem) wich is:

String strCondition = '';    
{...}
if(strSurname !=null){
   strCondition = strCondition + ' AND (customField3__c =\''+ strSurname+ '\' OR customField3__c =\'' + strSurname+ '\' OR customField3__c =\''+ strSurname+'\')';
}

So if i write that it works, but obviously i can't because it's not a fixed value, depends of the query param:

SELECT customField1__c, customField2__c, customField3__c FROM customObject__c WHERE customField2__c =: strVar1 AND (customField3__c ='Doe' OR customField4__c='Doe' OR customField5__c='Doe')

The log returns:

strCondition:  AND (customField3__c ='Doe' OR customField3__c ='Doe' OR customField3__c ='Doe')

Answer 1

The following syntax is not a dynamic query:

List<customObject__c> lstCstObj = [SELECT ... FROM ...];

What you need is a dynamic query. A dynamic query normally looks like:

String myQuery = 'SELECT ... FROM ...';
List<customObject__c> lstCstObj = Database.query(myQuery);

What you're after is probably something like:

// get the parameters
String strVar1 = String.valueOf(RestContext.request.params.get('name'));
String strSurname = String.valueOf(RestContext.request.params.get('surname'));

// create the query string
String myQuery = 'SELECT customField1__c, customField2__c, customField3__c, customField4__c, customField5__c FROM customObject__c WHERE customField2__c = :strVar1';

// add in the surname if it exists
if(String.isNotBlank(strSurname))
{
    myQuery += ' AND (customField3__c = \'' + String.escapeSingleQuotes(strSurname) + '\' OR customField4__c = \'' + String.escapeSingleQuotes(strSurname) + '\' OR customField5__c = \'' + String.escapeSingleQuotes(strSurname) + '\')';
}

List<customObject__c> lstCstObj = Database.query(myQuery);