0

I understand SOQL is a much restricted version of SQL but what are the potential risks associated with using dynamic SOQL? What damage could be done with malicious intent through it?

I'm just trying to understand, and potentially explain/mitigate, the risks associated to it's use.

Improve this question

1 Answer 1

Reset to default
1

Dynamic SOQL can open your application on risk of SOQL Injection.

If you must use dynamic SOQL, use the escapeSingleQuotes method to sanitize user-supplied input. This method adds the escape character (\) to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands.

Lets say your query is something like

String qryString = 'SELECT Id FROM Contact WHERE ' +
        '(IsDeleted = false and Name like \'%' + name + '%\')';

if the user provides unexpected input, such as:

// User supplied value for name: test%') OR (Name LIKE '

In that case, the query string becomes:

SELECT Id FROM Contact WHERE (IsDeleted = false AND Name LIKE '%test%') OR (Name LIKE '%')

Now the results show all contacts, not just the non-deleted ones.

You can read more about it at - http://www.salesforce.com/docs/developer/pages/Content/pages_security_tips_soql_injection.htm

Improve this answer
2
  • So the risk is exposing data only? Does this work around FLS or record visibility (assuming class with dynamic soql using "with sharing")?
    – Girbot
    Feb 11, 2015 at 17:14
  • If your class is defined "with Sharing" keyword then it will force record visibility rules , Only difference is how you write SOQL.
    – Jitendra Zaa
    Feb 11, 2015 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .