4

How can we avoid SOQL injection in JSforce code if we are using connection method to achieve connection and then further using SOQL. Is it not having SOQL in javascript not good practice? I am just wondering how to use JSforce in custom visual force pages but still write secured application? Any pointers will greatly help.

Improve this question

1 Answer 1

Reset to default
3

As this library is using API's there will be no issues like this.The Force.com REST and SOAP APIs allow end users to submit arbitrary SOQL strings. However, this does not lead to SOQL injection because the APIs include built in checks for sharing and CRUD/FLS permissions.

Have a look here https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_sql_injection.htm for your reference

Improve this answer
1
  • Thanks @kiran mutturu am trying to get my head around these stuff. It uses API and hence has to obey sharing settings. Got it, thanks!
    – Manju
    Commented Mar 18, 2015 at 2:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .