I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; delete [SELECT Id FROM Contact]; // to delete all contacts from an org. Is something like this possible, or does Apex prevent this?

Example below. I tried running this, but am getting the error mismatched character '<EOF>' expecting '''

    // whereClause value: Name LIKE '%')'; delete [SELECT Id FROM Contact]; //
    public static void soqlInjectionTest(String whereClause) {
        String queryString = 'SELECT Id FROM Contact WHERE ' + whereClause;
        List<Contact> contacts = Database.query(queryString);

2 Answers 2


Apex compiler will error out as you cannot provide apex statement as string and then expect compiler to compile automatically.

  • thanks for your answer but i think you misunderstood my question. I'm not asking how to prevent SOQL injection, i'm asking if it's possible for a user to supply input that contains an Apex statement, and for that statement to be considered code and be executed? In my example the user supplies an input string that contains delete [select id from Contact];. I tried that but i'm getting the error mismatched character '<EOF>' expecting ''', so the statement does not actually execute.
    – Tom
    Commented Feb 17, 2023 at 1:02
  • 1
    Ah Thanks for clarifying it Commented Feb 17, 2023 at 1:03
  • 1
    Fixed the answer Commented Feb 17, 2023 at 1:04

SOQL and SQL are distant cousins. Unlike SQL, you cannot have multiple statements in SOQL, can't execute arbitrary Apex, and you can't even perform DML statements of any kind. As such, the absolutely worst possible scenario is that someone can see data they shouldn't, and even that requires elevated privileges (which is why you should always use with sharing/inherited sharing).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .