0

I tried that as well but unable to resolve the problem. It still says the challenge is not solved.

public class Prevent_SOQL_Injection_Challenge 
{

    public string textOne {get; set;}
    public string textTwo {get; set;}
    public string comparator {get; set;}
    public string numberOne {get; set;}

    public List<Supply__c> whereclause_records {get; set;}

    public PageReference stringSearchOne()
    {
        string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';
        string whereClause = '';

        if(textOne != null && textOne!=''){
                whereClause += 'name like  \'%'+string.escapeSingleQuotes(textOne)+'%\' ';
        }

        if(whereClause != ''){
            whereclause_records = database.query(query+' where '+whereClause+' Limit 10');
        }

        return null;
    }

    public PageReference stringSearchTwo()
    {
        string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';
        string whereClause = '';

        if(textTwo != null && textTwo!=''){
                whereClause += 'Storage_Location__r.name like  \'%'+string.escapeSingleQuotes(textTwo)+'%\' ';
        }

        if(whereClause != ''){
            whereclause_records = database.query(query+' where '+whereClause+' Limit 10');
        }

        return null;
    }

    public PageReference numberSearchOne()
    {
        string query = 'SELECT Id,Name,Quantity__c,Storage_Location__c,Storage_Location__r.Castle__c,Type__c FROM Supply__c';
        string whereClause = '';

        if(numberOne != null && comparator != null){
            whereClause += 'Quantity__c '+string.escapeSingleQuotes(comparator)+' '+string.escapeSingleQuotes(numberOne)+' ';
        }

        if(whereClause != ''){
            whereclause_records = database.query(query+' where '+whereClause+' Limit 10');
        }

        return null;
    }
}
4
  • I tried that as well if you can see in the above code it is not working. Please let me know if there is missing something from my code.
    – RCS
    Commented Oct 18, 2016 at 6:46
  • 1
    Do you get a specific message?
    – Adrian Larson
    Commented Oct 18, 2016 at 12:47
  • I don't have any code related message but when I check the challenge in trailhead "Challenge Not yet complete... here's what's wrong: Your Apex code still appears to be vulnerable to SOQL injection. Please check your code again."
    – RCS
    Commented Oct 19, 2016 at 3:01
  • Finally completed the challenge by changing the type of variable numberOne from String to Integer.
    – RCS
    Commented Oct 19, 2016 at 3:09

0

Browse other questions tagged .