4

Given the following query:

public List<Account> selectById(Set<String> names)
{
    String query = 'SELECT Id, Name FROM Account WHERE Name IN :names ORDER BY Name';
    List<Account> records = Database.query(query);
    return records;
}

Should the names collection be sanitized in the following query before it gets to the query?

for (String name : names) 
{
    name = String.escapeSingleQuotes(name);
}
2
  • You can do binding in the string itself and use Database.query() to execute it?! You just made my day!! Jul 3, 2019 at 12:01
  • 2
    Be aware you can't bind to anything like a function call result or object property/field value without the use of a local variable initialized from the value in a dynamic query string, unlike a static query.
    – Phil W
    Jul 3, 2019 at 18:27

1 Answer 1

8

The short answer is no. Because you are using a binding there is no possibility for the value to introduce an SOQL injection attack. It is only when you are textually inserting the value into a generated query that you need to do the escaping.

2
  • 2
    Why is this the "short answer"? There could be other vulnerabilities? Jul 3, 2019 at 12:02
  • 1
    @BrianMiller, nah, just that it is a literally short answer. "No." I then added a bit of detail :)
    – Phil W
    Jul 3, 2019 at 12:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .