How can we add colon to a string value before dynamic soql query

Question

I have a soql statement which is used to soql the result from a sObject but I need to mention the id in the soql how can add colon to the both side of id. my requirement

SELECT Result__c,Notes__c FROM Visits__c WHERE Is_latest__c = true and projectGroupId__c = '4390283nknfdkjs' and survey__c != null and Project_Group__c != null limit 1

But I am not getting the colon because of it the dynamic soql is getting error. my string soql

soqlQuery = 'SELECT '+ survey.Included_Questions__c +' FROM Visits__c WHERE Project_Group__r.id ='+projectGroupId+' and Is_latest__c = true and survey__c != null and Project_Group__c != null limit 1';

please guide me how to achieve it.

Answer 1

One version of your dynamic SOQL that would work is to include the quotes that are required around a literal ID value like this:

soqlQuery = 'SELECT '+ survey.Included_Questions__c +' FROM Visits__c '
        + 'WHERE Project_Group__r.id =\''+projectGroupId+'\' and Is_latest__c = true and survey__c != null and Project_Group__c != null limit 1';

Another approach is to have the simple bind variable projectGroupId in scope when you execute the query, and then you can just have the variable name after a colon in the SOQL:

soqlQuery = 'SELECT '+ survey.Included_Questions__c +' FROM Visits__c '
        + 'WHERE Project_Group__r.id = :projectGroupId and Is_latest__c = true and survey__c != null and Project_Group__c != null limit 1';

This approach avoids the SOQL injection risk on that field.