Second order SOQl/SOSL injection error during checkmarx scan

Question

I am getting SOQL injection at line originalObjectQuery += ' WHERE Id = '' + originalId + '''; How can i reslove this?

public static Id close(Id originalId) {
    //** Build query to return the full object from an Id
    List<String> sObjectFields = new List<String>();
    Map<String, Schema.SObjectField> fieldMap = originalId.getSObjectType().getDescribe().fields.getMap();
    for (String fieldName : fieldMap.keySet()) {
        if (isCloseSafe(fieldMap.get(fieldName))) {
            sObjectFields.add(fieldName);
        }                        
    }
    String originalObjectQuery = 'SELECT ID, ' + sObjectFields[0];
    for (Integer i = 1; i < sObjectFields.size(); i++) {
        originalObjectQuery += ', ' + sObjectFields[i];
    }
    originalObjectQuery += ' FROM ' + originalId.getSObjectType().getDescribe().getName();
    originalObjectQuery += ' WHERE Id = \'' + originalId + '\'';
    //** Execute query to return the full object from an Id
    List<sObject> originalObject = new List<sObject>();
    if(originalObjectQuery!=null && !String.isBlank(originalObjectQuery)){
        originalObject.addAll(Database.query(originalObjectQuery)));

Answer 1

Another way to indisputably remove any injection vulnerability is to use a merge variable instead.

'WHERE Id = :originalId'

Answer 2

It's a false positive. Since Id variables always validate their input, there's no need to do anything special. If you really want to get rid of this warning, use String.escapeSingleQuotes:

originalObjectQuery += ' WHERE Id = \'' + String.escapeSingleQuotes(originalId) + '\'';