3

I having a problem getting the ID of the entity company selected from the dropdownlist. The value passes correctly to the class, but the SOQL query is returning the ID of the Company.com-KY even if I select one of the other ones. I am preatty sure that the problem is because I am using this: WHERE Name LIKE \'%'+String.escapeSingleQuotes(l)+'%\' LIMIT 1';

My question is if there is another way to get the Id using for example 'Where name ='

I already tried this:

soql = 'SELECT Id FROM Entity_c WHERE Name='+String.escapeSingleQuotes(l)+''; soql = 'SELECT Id FROM Entity_c WHERE Name= \'%'+String.escapeSingleQuotes(l)+'%\' ';

Thank you!

Here is my VF page dropdown list

  <select id="list" size="1" onChange="doSearch();"  >
   <option value="-" selected="selected">Select Entity</option>
   <option value="Company" >Company</option>
   <option value="Company.com">Company.com</option>
   <option value="Company.com-KY">Company.com-KY</option>
   </select>

Here is the class

 public PageReference runSearch() {    
 String entity = Apexpages.currentPage().getParameters().get('list');


 soql = 'SELECT Id FROM Entity__c WHERE Name like \'%'+String.escapeSingleQuotes(entity)+'%\' LIMIT 1';

 runQuery(); 

return null;

}

here is query and how assign the entity id to a variable

  public void runQuery() {

try {
  entity = Database.query(soql);
  objectlist =String.valueOf(entity);
  msg = 'Entity selected successfully !'; 

} catch (Exception e) {
  ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.ERROR, 'Ooops!'));
}

}

2
  • Is there a particular reason you are using "Like"? If you made the query specific to a name, you would get back the ID you want.
    – joshbirk
    Commented Apr 10, 2014 at 18:54
  • But I don't know how to do that, i would like to use where Name = but I dont know how to built the where statement using \'%'+String.escapeSingleQuotes(l)+'%\'
    – Carlos
    Commented Apr 10, 2014 at 18:58

2 Answers 2

3

Shift your query to a specific Name instead of LIKE:

public PageReference runSearch() {    
     String entity = Apexpages.currentPage().getParameters().get('list');
     try {
         objectlist = [SELECT Id from Entity__c WHERE Name = :entity];
     } catch (DMLException e) {
         //handle e
     }


     return null;

    }
2
  • 2
    Not the use of a bind variable here (:entity) instead of string manipulation to create the query - always the better plan. Use of a bind variable prevents SOQL injection (see salesforce.com/us/developer/docs/apexcode/Content/…), so you don't need to use String.escapeSingleQuotes(entity). Commented Apr 10, 2014 at 19:26
  • Good point @JasonClark - removing the string call from the sample in the answer. And yes, avoid stringifying your own query call whenever possible.
    – joshbirk
    Commented Apr 10, 2014 at 20:10
0

Try to use built in apex components when you can. Use the <apex:selectList> and <apex:selectOption> to bind your data directly to your controller instead of passing it through page parameters. Doing it this way is safer and more efficient.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .