I'm looking at publishing an application on AppExchange - most of this application is built using point-and-click, no APEX was needed for the first releases. There is a couple of fields that I want to prepopulate when creating new records. This is pretty straightforward to do using a "URL Hack" and a custom button.

My concern is that this will not pass security review since it is using an undocumented / unsupported API. What other approaches are there to solve my problem?

  • Just for my knowledge, what is the error you see or expect to see when you are giving it for security review? Apr 10, 2015 at 10:48
  • I've seen on multiple places that it would not pass security review. The reason being it an unsupported hack. I also assume it wouldn't work since the field id's may be different when installed into client orgs.
    – haagen
    Apr 10, 2015 at 13:26
  • Ahhh I see.... The only other way I can think of is over-riding the button/link with a VF page and populate the fields there. Don't think there is any standard functionality for what you need and any hacks are certainly out of the question now. But do share here if you are able to figure out any other solution. Cheers! Apr 10, 2015 at 13:36

2 Answers 2


There is not a specific prohibition against hacks in the security review, and you wont be failed just for doing something in a non-standard way. In this specific case, you will need to be careful to avoid the following issues:

1) CSRF -- automatically pre-populating a form field is OK, auto-submitting a form is not. No DML operation can occur as the result of a page load with specific URL parameters.

2) JS in Salesforce DOM -- Don't include your own javascript in the salesforce domain, use the force.com domain instead for your app.

In general, pre-populating fields and adding fields to related records can be securely accomplished in Apex (server side), or with Javascript using VF remote object calls (client side) and I would recommend that you use that.


You can specify default values for fields

  • This is not enough since I want to use a value entered into a field, by the user, on a parent record and put that into a field when I create a new Child record. This so that the user won't have to retype. This value ould likely be different on every record creation.
    – haagen
    Apr 10, 2015 at 13:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .