How can we prevent SOQL injection when using AJAX toolkit while querying records using sforce library. For e.g if there is a query written as below

var result = sforce.connection.query("select name, id from account where Id= '" + accountId +"'").getArray("records");

Will escpaing single quotes from accountId as shown below will work,

var result = sforce.connection.query("select name, id from account where Id= '" + accountId.replace(/'/g, "\\'") +"'").getArray("records");

since we can modify javascript on client side

Or is there any other way through which we could handle SOQL attack.

  • as well as that would still be some JS that is executed on client side, potentially someone may open source of it and manually change accountId right before execution, so it would not help. If that is critical for you, I would recommend you to use visualforce remoting, and perform extra validation on server side – kurunve Mar 16 '16 at 8:11
  • that would have been the best option if the JS was being used in one VF, but we are using the JS across multiple VF. Also JS is stored as static resource. – anmrk Mar 16 '16 at 8:51
  • You can define some generic remoting pattern, and use it at single line of code at every page, and move away JS logic to Static Resource. For example, in my case on Page I have: $RemoteAction = "{!$RemoteAction.cls_RemoteActionConnector.processRemoteAction}"; as well as in static resource I have something like : var vfManager = Visualforce.remoting.Manager; var requestParams = {"RequestName":'act', "RequestBody":params}; var vfActionParams = [$RemoteAction, requestParams, callback, { escape:true }]; vfManager.invokeAction.apply(vfManager, vfActionParams);. Apex code do some logic up to 'act' – kurunve Mar 16 '16 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.