Given the following query:

public List<Account> selectById(Set<String> names)
    String query = 'SELECT Id, Name FROM Account WHERE Name IN :names ORDER BY Name';
    List<Account> records = Database.query(query);
    return records;

Should the names collection be sanitized in the following query before it gets to the query?

for (String name : names) 
    name = String.escapeSingleQuotes(name);
  • You can do binding in the string itself and use Database.query() to execute it?! You just made my day!! – Brian Miller Jul 3 '19 at 12:01
  • 2
    Be aware you can't bind to anything like a function call result or object property/field value without the use of a local variable initialized from the value in a dynamic query string, unlike a static query. – Phil W Jul 3 '19 at 18:27

The short answer is no. Because you are using a binding there is no possibility for the value to introduce an SOQL injection attack. It is only when you are textually inserting the value into a generated query that you need to do the escaping.

  • 2
    Why is this the "short answer"? There could be other vulnerabilities? – Brian Miller Jul 3 '19 at 12:02
  • 1
    @BrianMiller, nah, just that it is a literally short answer. "No." I then added a bit of detail :) – Phil W Jul 3 '19 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.