So I have built an apex page as follows...

    <apex:pageBlockSection >
                <apex:inputField value="{!Tree__c.Tree_Type__c}" />
                <apex:inputField value="{!Tree__c.Diseases__c}" />

  <apex:outputPanel >
                    <apex:commandButton value="Search" action="{!doSearch2}"
                        reRender="block" status="status" />

And I have built a controller as follows (I am trying to get a few fields working to start with, hence the code comments...

           soql = 'Select Tree_Type__c, Tree_Surgeon__c, Diseases__c, Status__c, Date_of_Planting__c, Native_breed__c from Tree__c WHERE';
    if (!varTreeType.equals(''))
      soql += ' Tree_Type__c LIKE "+varTreeType+"';

  //  if (!lastName.equals(''))
  //    soql += ' and lastname LIKE "+lastName+"';

  //  if (!accountName.equals(''))
  //    soql += ' and account.name LIKE "+accountName+"';

  //  if (!technology.equals(''))
  //    soql += ' and interested_technologies__c includes ("+technology+")';

How do I get the values of the VisualForce form fields, and use them within the query?

  • Are you trying to create a search form, or a data entry form? In general to preserve data access rules you want to create either one or the other? – pchittum Nov 26 '14 at 13:20
  • @Peter I am building a simple search form, that will display list of objects matching the criteria, the user can then select these items and go to a edit/print form. – developer__c Nov 26 '14 at 13:24

Assuming you are using the tree fields because they are values such as picklists, and that you are using a controller extension, this code will build the dynamic query making use of bind variables which are safe from SOQL injection attack:

private ApexPages.StandardController sc;

public MyController(ApexPages.StandardController sc) {
    this.sc = sc;

private void yourQueryMethod() {

    Tree__c filter = (Tree__c) sc.getRecord();

    String[] wheres = new String[] {};
    String treeTypeLike;
    String diseasesLike;
    if (filter.Tree_Type__c != null) {
        wheres.add('Tree_Type__c LIKE :treeTypeLike');
        treeTypeLike = '%' + filter.Tree_Type__c + '%';
    if (filterDiseases__c != null) {
        wheres.add('Diseases__c LIKE :diseasesLike');
        diseasesLike = '%' + filter.Diseases__c + '%';
    String soql = 'Select ... from Tree__c'
            + (wheres.size() > 0 ? ' WHERE ' : '')
            + String.join(wheres, ' AND ');
  • Implementing this (and deleting my old constructor) gives me an meaningless error - Unknown constructor MySecondController.MySecondController(ApexPages.StandardSetController controller) – developer__c Nov 26 '14 at 14:16
  • 1
    @buzzlightyear The constructor name has to be the same as you class name. – Keith C Nov 26 '14 at 14:45
  • it is the same ;) – developer__c Nov 26 '14 at 14:46
  • @buzzlightyear Are you intentionally or accidentally using StandardSetController? To use that you page needs to define the recordSetVar in the apex:page. – Keith C Nov 26 '14 at 15:01
  • With lots of modification of controllers. I have managed to resolve the issue using your solution. – developer__c Nov 26 '14 at 16:25

Try removing the double quotes like this :

soql = 'Select Tree_Type__c, Tree_Surgeon__c, Diseases__c, Status__c, Date_of_Planting__c, Native_breed__c from Tree__c WHERE';
    if (!varTreeType.equals(''))
      soql += ' Tree_Type__c LIKE ' + varTreeType;
  • As the code is in the controller class, it does not recognize the variable from the visualforce page. – developer__c Nov 26 '14 at 13:26
  • How do you get/construct the varTreeType variable in your controller ? – SF_user Nov 26 '14 at 13:28
  • I was usingString varTreeType = Apexpages.currentPage().getParameters().get('treeType'); however this only works with URL parameters? – developer__c Nov 26 '14 at 13:30
  • Yes, it gets the value of the URL parameter treeType. – SF_user Nov 26 '14 at 13:34
  • 1
    Passing URL parameters as search criteria opens your code to vulnerability. I suggest avoiding that. – pchittum Nov 26 '14 at 13:42

You could use

<apex:inputField value="{!treeType}" />
<apex:inputField value="{!diseases}" />

in your Visualforce page. Do not forget to make properties in your controller class:

public String treeType { get; set; }
public String diseases { get; set; }

and this will change values of your properties depending on your text in your inputFields. Then you could build a query like that:

soql = 'SELECT Tree_Type__c, Tree_Surgeon__c, Diseases__c, Status__c, Date_of_Planting__c, Native_breed__c FROM Tree__c WHERE';
if (!treeType.equals(''))
  soql += ' Tree_Type__c LIKE \'' + treeType + '\'';

Note the \'. Backslash and single quote will force your string to have a single quote inside it without closing the string(for more info read about Escape Character).


Your form will need a few text boxes like this:

  <apex:commandButton action="{!doSearch}" value="Search"/>
    <apex:outputLabel value="Tree Type"/>
    <apex:inputText value="{!varTreeType}" />
    <apex:outputLabel value="Last Name"/>
    <apex:inputText value="{!lastName}" />

You will then need some properties in your controller that will bind to these:

public String varTreeType {get;set;}
public String lastName {get;set;}

The doSearch in the command button would just bind to the method you've already created that is invoking the string search. One important thing, though is that you want to make sure to prevent SOQL injection. So a safer implementation of these properties would be:

public String varTreeType {
  set {
    varTreeType = String.escapeSingleQuotes(value);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.