-2

I have developed this visualforce page based on Jeff Douglas's Roll Your Salesforce Lookup Popup Window

However, when I run a search or create a contact with a quote such as O'Neill or Store's, I get an Unexpected token error. I am wondering what steps I could take to allow to escape quotes.

Here's the visualforce class that I have.

public class ContactLookupControl {

  public Contact contact {get;set;} // new contact to create
  public List results{get;set;} // search results
  public string searchString{get;set;} // search keyword

  public ContactLookupControl() {
    contact = new Contact();
    // get the current search string
    searchString = System.currentPageReference().getParameters().get('lksrch');
    runSearch();  
  }

  // performs the keyword search
  public PageReference search() {
    runSearch();
    return null;
  }

  // prepare the query and issue the search command
  private void runSearch() {
    // TODO prepare query string for complex serarches & prevent injections
    results = performSearch(searchString);               
  } 

  // run the search and return the records found. 
  private List performSearch(string searchString) {

    String soql = 'select id, name,account.Name,MailingStreet,MailingCity,MailingState,MailingPostalCode,MailingCountry,Phone,Email from contact';
    if(searchString != '' && searchString != null)
      soql = soql +  ' where name LIKE \'%' + searchString +'%\'';
    soql = soql + ' limit 25';
    System.debug(soql);
    return database.query(soql); 

  }

  // save the new contact record
  public PageReference saveContact() {
    insert contact;
    contact=[select id,name,FirstName,LastName,AccountId,MailingStreet,MailingCity,MailingState,MailingPostalCode,MailingCountry,Phone,Email from contact where id=:contact.id];
    // reset the contact
    //contact = new Contact();
    return null;
  }

  // used by the visualforce page to send the link to the right dom element
  public string getFormTag() {
    return System.currentPageReference().getParameters().get('frm');
  }

  // used by the visualforce page to send the link to the right dom element for the text box
  public string getTextBox() {
    return System.currentPageReference().getParameters().get('txt');
  }
  }

Page

  • Please also do an isAccessible() check before returning the data to the user to check that this user has permission to view contacts at all and mark this controller as 'with sharing' to make sure that the user has permission to view those contacts that are returned by the query. Also, do an isCreateable() check to see if the user can create contacts, otherwise anyone installing this code in their organization will create a massive security hole. You are running in system mode, so please be careful. – Robert Sussland Oct 4 '15 at 20:12
  • Sure thing Robert, as I am fairly new to Apex code and mainly work as an administrator, I'd like to know how to run an isAccessible() check? – Medhanie Habte Oct 4 '15 at 23:25
2

You will want to use the escapeSingleQuotes Apex method.

  // run the search and return the records found. 
  private List performSearch(string searchString) {

      String soql = 'select id, name,account.Name,MailingStreet,MailingCity,MailingState,MailingPostalCode,MailingCountry,Phone,Email from contact';
      if(searchString != '' && searchString != null)
        soql = soql +  ' where name LIKE \'%' + String.escapeSingleQuotes(searchString) +'%\'';
      soql = soql + ' limit 25';
      System.debug(soql);
      return database.query(soql); 
  }

Should do the trick just fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.