FLS and CRUD check for User object

Question

I have a code which is inserting user object. It is created when the end user creates his account from force.com site. Since we cannot control FLS for user fields at profile level do we have to check it in code or can i skip it?

Answer 1

If you're using a Visualforce page and a standard controller, SFDC automatically checks this for you. In case you're writing custom controllers, you'll have to manually run the CRUD/FLS checks. These are enforced at the visualforce layer, not apex. This is a good blog post that contains some examples as well as a bit of an explanation on how it works and how it can be implemented.

Keep in mind though that FLS for any apex:inputField will be enforced, regardless whether you have a standard or custom controller.

As per the documentation (and Keith's Answer):

VisualForce will also remove fields for which users do not have FLS visibility when rendering edit pages. Additionally, all apex:inputField tags will be rendered as read-only elements for fields that are set to read-only through FLS. Please note that using other input tags such as apex:inputText or apex:inputTextArea with SObject fields indicate to VisualForce that the fields should not be treated as SObject fields and prevent the platform to automatically enforcing FLS