4

Using the Salesforce PHP Toolkit how can we safely execute queries? It doesn't seem like parameterized queries are supported. The only function I've seen is query() and that only takes in an SOQL with no additional parameters. Is there another option or do I need to do my own escaping function?

Here's my actual usage:

$query = "select Id
            from Contact
            where email = '{$data['email']}'";
$response = $SforceConnection->query($query);

and the $data['email'] is John.O'brien@gmail.com.

2
  • addslashes() is not secure, see this – user49132 Sep 14 '17 at 14:08
  • @ianhman Yes, I am aware (and have written that in my own answers (stackoverflow.com/questions/46137518/…)). However I'd call this a rare instance where it could be used. A user is never going to be accessing this tool. If you have a parameterized approach I'd be up for changing. – chris85 Sep 14 '17 at 14:31
3

I've not used the PHP toolkit but often methods exposed via API require you to do your own escaping like you suggest. The parameterisation is only available via Apex I believe. If you're really concerned about implementing this securely, you could write an Apex webservice that takes some parameters and call that using the PHP toolkit, but of course that means you need to make changes to the target org.

2
  • Thanks, that is what it was looking like from my searching. I'll accept this tomorrow if no one else has had more experience with the tool kit. If I had 2 more rep I'd upvote now. – chris85 Jan 10 '17 at 4:10
  • No worries, it's probably not the answer you wanted at any rate. Somebody might know a good sneaky workaround though! Welcome to the site! – Matt Lacey Jan 10 '17 at 4:22
0

My solution to the issue was using PHP's addslashes(). The tool kit appears to have no support for prepared statements at this time.

$query = "select Id
            from Contact
            where email = '" . addslashes($data['email']) . "'";
$response = $SforceConnection->query($query);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.