I have a query similar to this in one of our apps,

 List<Account> accountList = Database.query('SELECT Id,Name FROM Account WHERE Id IN:accIds');

But Checkmarx always gives SOQL Injection Error in report even when we are using variable binding. I also tried eascaping every single element in accIds, but still checkmarx gives SOQL Injection error. Can someone help in resolving this issue?

  • 1
    As this is a false positive (assuming your SOQL follows the same pattern) all you can do is note that it is a false positive when you submit your app for security review. The Checkmarx scanner has its limitations. Trying to construct a pattern that satisfies the Checkmarx scanner is introducing complexity for no reason.
    – Keith C
    Nov 5, 2014 at 17:47

1 Answer 1


This sample code should not result in a SOQL injection finding as the scanner knows about bound variables -- if it does, please forward your code to [email protected] and we will investigate the issue.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .