There is a field named "Email Opt Out" in the contact object. Can we query this field and put in the filter condition if the "Email Opt Out" field does not have both "Field-Level Security" and "Field Accessibility" in the apex class.

  • What filter condition? – pjcarly Jan 9 '13 at 10:24
  • In SOQL where condition. – Ugesh Gali Jan 9 '13 at 10:25

Apex doesn't enforce FLS:

Although Apex doesn't enforce object-level and field-level permissions by default, you can enforce these permissions in your code by explicitly calling the sObject describe result methods (of Schema.DescribeSObjectResult) and the field describe result methods (of Schema.DescribeFieldResult) that check the current user's access permission levels. In this way, you can verify if the current user has the necessary permissions, and only if he or she has sufficient permissions, you can then perform a specific DML operation or a query.



  • You can use user-inaccessible fields in a SOQL where clause
  • You can select user-inaccessible fields in a SOQL query, and so if you serialize an sObject in Apex you will include all selected fields, whether accessible to the user or not


You can perfectly query a field in a SOQL query that isn't visible to the user, you can filter on it, but you won't see it in visualforce or in the layout.

Unless you make the field visible ofcourse.

  • Thank you tested worked fine but I am returning a JSON which returns me the hidden field value. – Ugesh Gali Jan 9 '13 at 10:32
  • Could you elaborate a little more, are you just serializing the contact object? Are you creating a new object? What are you planning to do with the json string? where are you using it? – pjcarly Jan 9 '13 at 10:34
  • string testQry = 'Select Id, Name, Account.name, Account.Id, Email,EmailBouncedDate From Contact WHERE HasOptedOutOfEmail = true'; return as JSON.serialize(database.query(testQry )); returns hidden field also. – Ugesh Gali Jan 9 '13 at 10:51
  • this is correct, As you can see on the answer below, apex ignores field level security. By querying the data in soql, and serialising them in apex, you get the data like they exist in the database – pjcarly Jan 9 '13 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.