escapeSingleQuotes escape backslash character too?
From the document it mentions:
If you must use dynamic SOQL, use the escapeSingleQuotes method to sanitize user-supplied input. This method adds the escape character () to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands.
However if this only escapes single quote, in theory it does not prevent all kinds of SQL injections. For example,
- I can have this as string:
escapeSingleQuoteswill turn this into
- When this is appended to the query:
SELECT Id FROM Contact WHERE Email = 'test\\'@gmail.com'
Backslash character will also need to be escaped to prevent this. If
escapeSingleQuotes does escape backslashes too, it may be less confusing if the official document can be updated.