I have referred pmd ruleset but could not find the exact solution for this,please help?

opportunityListOH = new list<opportunity>();
        String query = 'Select Id, Name, StageName,Freeze__c,Freeze_Date__c,Owner.id,Owner.Name FROM Opportunity Where '+dateVal + Fixed + ' AND StageName = \''+ StageOptionsValueOH + '\''; 
        opportunityListOH = Database.query(query); <-- Error on this line

1 Answer 1


You need to use String.escapeSingleQuotes(str) for each one of your variables in query - dateVal Fixed StageOptionsValueOH because otherwise it could lead to Security vulnerability

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .