Apex Pmd : Apex classes should escape variables merged in DML query (rule: Security-ApexSOQLInjection)apex pmdApexSOQLInjection

Question

I have referred pmd ruleset but could not find the exact solution for this,please help?

opportunityListOH = new list<opportunity>();
        String query = 'Select Id, Name, StageName,Freeze__c,Freeze_Date__c,Owner.id,Owner.Name FROM Opportunity Where '+dateVal + Fixed + ' AND StageName = \''+ StageOptionsValueOH + '\''; 
        opportunityListOH = Database.query(query); <-- Error on this line

Answer 1

You need to use String.escapeSingleQuotes(str) for each one of your variables in query - dateVal Fixed StageOptionsValueOH because otherwise it could lead to Security vulnerability