I have given my code for Security code Scanner but it is given the following error due to

Query: Stored XSS

My query is like this.

loan=Database.query('SELECT Name, fintechLLC__Application__c, '+
                          'fintechLLC__Legal_Corporate_Name__c, '+
                          'fintechLLC__Last_Month_Trans__c, '+
                          'fintechLLC__X2_Month_ago_Trans_del__c, '+
                          'fintechLLC__X3_Month_ago_Trans__c, '+
                          'CreatedDate,fintechLLC__Monthly_Ending_Bal__c,Max_Rate__c, '+
                          'fintechLLC__Term__c,fintechLLC__Funding_Amount__c, '+
                          'fintechLLC__Business_DBA_Name__c,fintechLLC__Credit_Score__c, '+
                          'fintechLLC__Business_DBA_Years_in_Business__c, '+
                          'fintechLLC__Avg_Daily_Bank_Bal__c '+
                    'FROM fintechLLC__Loan__c '+
                    'WHERE id=\''+loanId+'\'');

Kindly help me in this

  • Is there any specific requirement for using Dynamic SOQL rather than standard SOQL?
    – highfive
    May 31, 2016 at 9:18

2 Answers 2


What is type of loanId and where does it code from? Is it a String or an Id?

Since you are using it to build a dynamic SOQL query you need to be extremely cautious with it. Especially since you have lots of terms like "Loan", "Bank", "Bal", "Credit_Score" in there.

For example, if it was a string from the URL query string I could try setting it to something like:

string loanId = '\' or ID!=\'\'';

Now that query will return all the fintechLLC__Loan__c records.

Is there a reason you need to use dynamic SOQL? As an alternative, you could use inline SOQL and using the Id type for loanId if you aren't already.

Id loanId = \\...
List<fintechLLC__Loan__c> loans = [SELECT Name, fintechLLC__Application__c,
                FROM fintechLLC__Loan__c 
                WHERE id=:loanId 
                limit 1];

Now it would only be possible to have an Id go into that query. Since you are asking for a single record, your could be extra cautious and add a limit as well. This is mostly superfluous though.

See also: SOQL Injection

  • loanID is a String where i am storing the RecordId May 31, 2016 at 9:06
  • 1
    Change it to be a strongly typed Id rather than a string and avoid the dynamic SOQL (Database.query) unless you really need it. May 31, 2016 at 9:09

your dynamic query will fail to read loanId and also instead of using Database.query(query) use the below method to get dynamic soql query result as list

Syntax should be like ..

List<custom_object> cu_list = [Select id, name from custom_object where id=:loanId] 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .