PHP Salesforce Toolkit Parameterized Queries/ SQL Injection Prevention

Question

Using the Salesforce PHP Toolkit how can we safely execute queries? It doesn't seem like parameterized queries are supported. The only function I've seen is query() and that only takes in an SOQL with no additional parameters. Is there another option or do I need to do my own escaping function?

Here's my actual usage:

$query = "select Id
            from Contact
            where email = '{$data['email']}'";
$response = $SforceConnection->query($query);

and the $data['email'] is John.O'[email protected].

Answer 1

I've not used the PHP toolkit but often methods exposed via API require you to do your own escaping like you suggest. The parameterisation is only available via Apex I believe. If you're really concerned about implementing this securely, you could write an Apex webservice that takes some parameters and call that using the PHP toolkit, but of course that means you need to make changes to the target org.

Answer 2

My solution to the issue was using PHP's addslashes(). The tool kit appears to have no support for prepared statements at this time.

$query = "select Id
            from Contact
            where email = '" . addslashes($data['email']) . "'";
$response = $SforceConnection->query($query);