In my app, I get passed in user-generated SOQL query strings and need to validate and modify them. For that, I would need a parser that can extract me chunks They contain many SOQL features like:

  • Query Parent Object fields
  • Query Child records
  • Conditions in own and child relationships
  • Aggregate functions

I tried to:

  1. "hack my own parser" and FAILED
  2. tried to port an open-source parser from Java to Apex and FAILED

Now I need your help to eighter point me to an existing solution that I didn't find yet or help me understand how to make 1) or 2) work.

Please also don't close-vote this question as too broad. Nobody is harmed when we leave it to hang around. Eventually, someone will be motivated by it to write such a parser.

1 Answer 1


I would really advise you not to do this.

Apex in its current form is really not suited for parsing and - more importantly - user-generated SOQL strings is a big security red flag. I know it's probably not the answer you wanted, but my advice would be to have a user-generated object-representation of the query (for example, an object representation of the fields, the objects, the filters, etc) and generate the SOQL downstream. This would avoid the parsing problem entirely and let you handle security robustly.

Plus, it's a fun object-oriented design exercise.

  • 3
    Totally agree with this. You need an abstraction of the query pieces to 1) ensure you don't break security and 2) to make it easier for the users to generate and submit the data.
    – Phil W
    Jul 17, 2020 at 9:24
  • 2
    @Lorenzo: I am hearing what you are saying but building a Custom Object or event Custom Metadata Structure to build even a simple SELECT fields FROM object WHERE X=Z is super hard. Imagine the UI you need to build, the checks to not create invalid statements. And Entity and Field relationships on CMDT will need another 5 years to come near that. Why not just use the Standard means to prevent SOQL injection and the like? Jul 17, 2020 at 12:39
  • 2
    @Lorenzo: it would also be nice if you could elaborate (at least) a bit on why Apex is so bad for parsing. Which language features are missing to make it work? Generics? I have seen them used in the Mulesoft Java Parser for Soql. Jul 17, 2020 at 14:52
  • 2
    @Robert Sösemann I actually think we should have more broad questions like this to increase discussions. Chat rooms and other meta features are rarely used.
    – Atlas Can
    Jul 18, 2020 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .