I have a query similar to this in one of our apps,

 List<Account> accountList = Database.query('SELECT Id,Name FROM Account WHERE Id IN:accIds');

But Checkmarx always gives SOQL Injection Error in report even when we are using variable binding. I also tried eascaping every single element in accIds, but still checkmarx gives SOQL Injection error. Can someone help in resolving this issue?

  • 1
    As this is a false positive (assuming your SOQL follows the same pattern) all you can do is note that it is a false positive when you submit your app for security review. The Checkmarx scanner has its limitations. Trying to construct a pattern that satisfies the Checkmarx scanner is introducing complexity for no reason. – Keith C Nov 5 '14 at 17:47

This sample code should not result in a SOQL injection finding as the scanner knows about bound variables -- if it does, please forward your code to sourcescanner@salesforce.com and we will investigate the issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.