I am integrating Salesforce With an External System through the RES/SOAP API. we have use cases eg User will enter Case related information in external System(UI) and case get created in Salesforce using standard Case RESTAPI call. In Another Use case External system will call QuerAll() REST API and pass the query String to get the data from Salesforce.
Customer wants to ensure that Salesforce REST/SOAP API takes care of escaping Malicious script/SQL Injection before Storing /Providing the data to the client.
I was not able find that in any of the security related docs. Salesforce has given only recommendations on how to Secure the custom code ,we write using Apex/VF from Cross Scripting/SQL Injection. but whether the standard API take care of that is not mentioned .
Can any help me in providing this information .