How can we avoid SOQL injection in JSforce code if we are using connection method to achieve connection and then further using SOQL. Is it not having SOQL in javascript not good practice? I am just wondering how to use JSforce in custom visual force pages but still write secured application? Any pointers will greatly help.


As this library is using API's there will be no issues like this.The Force.com REST and SOAP APIs allow end users to submit arbitrary SOQL strings. However, this does not lead to SOQL injection because the APIs include built in checks for sharing and CRUD/FLS permissions.

Have a look here https://developer.salesforce.com/page/Secure_Coding_SQL_Injection for your reference

| improve this answer | |
  • Thanks @kiran mutturu am trying to get my head around these stuff. It uses API and hence has to obey sharing settings. Got it, thanks! – Manjunath Nimbal Mar 18 '15 at 2:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.