I am trying to write dynamic SOQL queries, but I don't know the exactly correct way how to escape the multiselect picklist with multiple categories included the way it is working and not vulnerable to soql injection.
Here is the querying of multiselect picklist described without the escaping.
How can I pass variables with some categories etc to customize the query dynamically to select one or other (separated by comma) in one query?
This always return nothing. But separating with ';' works, because there are some values which consists both categories... How it is supposed work?
String category = 'ProductCat1,ProductCat2';
String soql = 'select Id, Category from Case where Category__c includes (:category) ';
Database.query(soql); // doesn't return