I'm trying to debug this code that another developer created. I think the code is trying to create a string that's a query. The reason that I need to fix is is that if the value 'strSelectedProductIdentifier' has a ' character then it breaks a button and does not do any action.
Example:
public void addIntoSelectedProduct()
{
String query = 'SELECT ';
set<String> setFields = new set<String>(); // set to check Product_Identifier__c field exist in fieldset or not
for(Schema.FieldSetMember f : SObjectType.Product2.FieldSets.SL_ProductMgtTool.getFields()) {
query += f.getFieldPath() + ', ';
setFields.add(f.getFieldPath());
}
query += 'Family, ';
//handled this issue for product identifier with single quote
System.debug('Product identifier is::' + strSelectedProductIdentifier);
strSelectedProductIdentifier = strSelectedProductIdentifier.contains('%%%%%%') ? strSelectedProductIdentifier.replace('%%%%%%', '\''):strSelectedProductIdentifier;
System.debug('Product identifier is::' + strSelectedProductIdentifier);
if(setFields.isEmpty())
ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.ERROR, 'Please select a field in fieldset.'));
else
{
if(setFields.contains('Product_Identifier__c'))
query += 'Id FROM Product2 WHERE isActive = true AND Product_Identifier__c =\''+strSelectedProductIdentifier+'\' ';
else
query += 'Id, Product_Identifier__c FROM Product2 WHERE isActive = true AND Product_Identifier__c =\''+strSelectedProductIdentifier+'\' ';
//based on the select product, create a new wrapper
lstProduct2Wrapper.add(new product2Wrapper(Database.Query(query), objOpp, strSelectedRetailer, strSelectedAU));
}
}
My question is what does the += mean when it goes query +=. I know that if you do string + string then that concatenates the values together. I've never seen += together like that and I'm confused.
strSelectedProductIdentifier
is actually adding an injection vulnerability...why the heck are you adding that string replacement?