I am facing soql injection issue in my dynamic query, i have done with sting.escapesinglequotes() also but still facing this issue. here is my code.

query: query = 'select id,Name,Owner.Id from ' + ObjectSelected + ' where ownerid =\'' + String.escapeSingleQuotes(objCurrentOwner) + '\'' +getfilters();


public string getfilters(){
       string filter = '';
       for(FilterWrapper fw:lstFldWrap){
           if(fw.field!='--select field--' && fw.operand!=NULL && fw.operand!='')

                      {  filter+= ' AND '+fw.field+' '+fw.operator.replace('{val}',fw.operand);   }
                     {   filter+= ' AND (NOT '+fw.field+' '+fw.operator.replace('NOT','').replace('{val}',fw.operand)+')';   }

                    string FldType = string.valueOf(fieldMap.get(fw.field).getDescribe().getType());

                   fw.operand = '\''+fw.operand+'\'';
                   system.debug('operand' +fw.operand);
                   if(FldType=='DATE' || FldType=='DATETIME' || FldType=='CURRENCY' || FldType=='DOUBLE' || FldType=='INTEGER'){
                       fw.operand  = fw.operand.replace('\'',''); 
                       system.debug('operand' +fw.operand);
                   filter+= ' AND '+fw.field+fw.operator+fw.operand;

               system.debug('filter***' +filter);
             //  if(fw.field.contains('date'))
               //    filter = filter.replace('\'','');
        system.debug('Filter****' +filter);
        return filter;
  • I wonder if it is a false positive. Have you checked this by testing it on the website ui or did a code scanner tool report it.
    – Anup
    Commented Dec 1, 2014 at 8:10
  • Yes, i have already sent it for scanner & it failed with security scanner,because of SOQL injection
    – user7374
    Commented Dec 1, 2014 at 8:41
  • Then it could be a false positive. These scanners are not perfect. The best way to resolve/confirm this would be to test it via the UI. Google some examples of how to do soql injection and try it out on your webpage to see if it allows it.
    – Anup
    Commented Dec 1, 2014 at 8:51

1 Answer 1


There are two tasks to achieve here:

  1. To protect your code against SOQL injection while also having working code
  2. To get your solution through a security review either by getting the automated security scanner to report no problems or to add a note about why the positive is a false positive

On 1), it is the fw.operand values that should be escaped not the overall filter string, otherwise you will be escaping quotes that should not be escaped. Your unit test cases for this code need to cover multiple permutations including ones with embedded quotes.

On 2), which is only worth doing once your are confident that your code is correct functionally and in relation to security, you may well end up having to explain a false positive report from the security scanner because its analysis of the code has limitations. But as long as the explanation you submit is clear (and references the test cases to demonstrate you have the problem solved) that will not stop your app getting through the overall security review process.

  • so can i submit it for security review with igoring scanner results?
    – user7374
    Commented Dec 1, 2014 at 17:16
  • @user7374 You can't ignore them. You need to submit a document explaining why the false positives are not genuine security issues. (And be sure they are not genuine security issues. You are unlikely to get through the review if your explanations are weak or questionable.)
    – Keith C
    Commented Dec 1, 2014 at 17:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .