System.QueryException: unexpected token: = Error is in expression '{!dosearch}' in component

Question

public class search {
public search(){
soql = '';
service = new list<Service__c>();
}
public string soql;
public string city{get;set;}
public list<Service__c> service{get;set;}
public void dosearch(){
 soql = '';
 soql = soql + 'select id,name,Bus_Type__c,From__c from Service__c';
 soql = soql + 'Where From__c = ' + '\''+city+'\'';
 system.debug('choos=================>' +soql);
 service = new list<Service__c>();
 service = database.query(soql);// Error hear
}
}

Visualforce

<apex:inputText value="{!city}"/>
<apex:commandButton value="Search" action="{!dosearch}"/> //Error
<apex:pageBlock title="Display Value">
<apex:pageblockTable Value="{!service}" var="v">
<apex:column value="{!v.name}"/>
<apex:column value="{!v.Bus_Type__c}"/>
</apex:pageblockTable>
</apex:pageBlock>

Answer 1

you have problem with string query. Do not use string for SOQL query, until you have to do it, because dynamic SOQL is vulnerable to SOQL Injections. There are two ways to prevent possible SOQL Injections for dynamic queries:

1. Use String.escapeSingleQuotes(String) method for your city parameter

public void dosearch(){ soql = 'select id, name, Bus_Type__c,From__c ' +'from Service__c ' +'where From__c = \''+String.escapeSingleQuotes(city)+'\''; service = Database.query(soql); }

1. Use simple bind variables :city

public void dosearch(){ service = [ select id, name, Bus_Type__c,From__c from Service__c where From__c = :city ]; }