4

I'm trying to debug this code that another developer created. I think the code is trying to create a string that's a query. The reason that I need to fix is is that if the value 'strSelectedProductIdentifier' has a ' character then it breaks a button and does not do any action.

Example:

 public void addIntoSelectedProduct()
{
    String query = 'SELECT ';
    set<String> setFields = new set<String>(); // set to check Product_Identifier__c field exist in fieldset or not
    for(Schema.FieldSetMember f : SObjectType.Product2.FieldSets.SL_ProductMgtTool.getFields()) {
        query += f.getFieldPath() + ', ';
        setFields.add(f.getFieldPath());
    }
    query += 'Family, ';
    //handled this issue for product identifier with single quote
    System.debug('Product identifier is::' + strSelectedProductIdentifier);
    strSelectedProductIdentifier = strSelectedProductIdentifier.contains('%%%%%%') ? strSelectedProductIdentifier.replace('%%%%%%', '\''):strSelectedProductIdentifier;
    System.debug('Product identifier is::' + strSelectedProductIdentifier);
    if(setFields.isEmpty())
        ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.ERROR, 'Please select a field in fieldset.'));
    else
    {    
        if(setFields.contains('Product_Identifier__c'))
            query += 'Id FROM Product2 WHERE isActive = true AND Product_Identifier__c =\''+strSelectedProductIdentifier+'\' ';
        else
            query += 'Id, Product_Identifier__c FROM Product2 WHERE isActive = true AND Product_Identifier__c =\''+strSelectedProductIdentifier+'\' ';

        //based on the select product, create a new wrapper
        lstProduct2Wrapper.add(new product2Wrapper(Database.Query(query), objOpp, strSelectedRetailer, strSelectedAU));
    }
}

My question is what does the += mean when it goes query +=. I know that if you do string + string then that concatenates the values together. I've never seen += together like that and I'm confused.

3
  • Your wild logic around strSelectedProductIdentifier is actually adding an injection vulnerability...why the heck are you adding that string replacement?
    – Adrian Larson
    Dec 29, 2016 at 19:41
  • 1
    The short answer is already given by other users: "x += s" is a short form (sugar) of "x = x + s". However, a complete answer to your question must say "DO NOT DO IT!!!" The code you show is the typical one that can be attacked by an sql injection. Use it only in safe environments (internal to the company) and applications that handles assets of no value nor data privacy requirements. Better, do not use it at all.
    – user40414
    Dec 29, 2016 at 19:43
  • @AdrianLarson that was there before me.. it is an internal only vf page that does product selections but yeah I'm changing that around to strSelectedProductIdentifier = String.escapeSingleQuote(strSelectedProductIdentifer); Dec 29, 2016 at 19:49

2 Answers 2

8

+=, and other related operators, are often called short-hand operators. They serve the role of reducing the amount of typing you have to do when you want to modify the same variable you're assigning to, which is incredibly common. In addition to +=, there are other things you can do as well:

Integer a = 100;

a /= 5; // Divide; a is now 20
a *= 5; // Multiply; a is now 100
a -= 6; // Subtract; a is now 94
a += 4; // Add; a is now 98

a ^= 33; // XOR; a is now 67
a &= 63; // AND; a is now 3
a |= 9; // OR; a is now 11
a <<= 1; // Shift-Left; a is now 22
a >>= 2; // Shift-Right; a is now 5
a = -1000000; // Used for the next step
a >>>= 2; // Unsigned-Bit-Shift-Right; a is now 1073491824

If you don't understand the last section, that's okay, as you'll rarely use them until you get to more advanced programming. You might want to read more about "Boolean algebra" if you're interested, though.

You can read more about operators here.

1
  • These operators are used in many, many, other languages, so it should be a familiar concept. As should rembering to add whitespace padding on preceding lines when assembling a long string (not always but especially, for queries).
    – mckenzm
    Dec 30, 2016 at 2:43
8

+= is an operand that basically mimics x = x +.

In this case, query += "aa" means query = query + a. In effect, you are adding the new value to the original.

This works as well for numbers. For example, a+=1 equals a = a + 1, thereby incrementing a by 1.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .