How can we avoid SOQL injection in JSforce code if we are using connection method to achieve connection and then further using SOQL. Is it not having SOQL in javascript not good practice? I am just wondering how to use JSforce in custom visual force pages but still write secured application? Any pointers will greatly help.

1 Answer 1


As this library is using API's there will be no issues like this.The Force.com REST and SOAP APIs allow end users to submit arbitrary SOQL strings. However, this does not lead to SOQL injection because the APIs include built in checks for sharing and CRUD/FLS permissions.

Have a look here https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_sql_injection.htm for your reference

  • Thanks @kiran mutturu am trying to get my head around these stuff. It uses API and hence has to obey sharing settings. Got it, thanks!
    – Manju
    Mar 18, 2015 at 2:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .