Skip to main content
The 2024 Developer Survey results are live! See the results

Questions tagged [soql-injection]

SOQL injection involves taking user-supplied input and using those values in a dynamic SOQL query. If the input is not validated, it can include SOQL commands that effectively modify the SOQL statement and trick the application into performing unintended commands.

Filter by
Sorted by
Tagged with
1 vote
1 answer
84 views

How to handle ApexSOQLInjection for Dynamic Query

I have the following dynamic query: String orderBy = ...; //Some value String query = 'SELECT ' + String.join(fields, ', ') + ' FROM SObject__c WHERE Id IN :ids ORDER BY ' + orderBy + ' NULLS LAST'; ...
PieterJacob's user avatar
4 votes
2 answers
712 views

ApexSOQLInjection clarification with respect to binding of variables

I went through the trailhead module on SOQL injection, however I am not clear on below items: Scenario 1) Is escapeSingleQuotes here needed ? // Consider that userinput is coming from user userinput =...
Kiran Machhewar's user avatar
-2 votes
1 answer
205 views

Apex classes should escape variables merged in DML query (rule: Security-ApexSOQLInjection) - how to fix this? [duplicate]

There is one warning (mention above) in one line, please tell me how to fix? public with sharing class VIT_CustomLookupController { // Method to fetch lookup search result @AuraEnabled(...
Ameeta Chaudhury's user avatar
-1 votes
1 answer
76 views

SOQl Injection Checkmarx issues

I am getting SOQL Injection checkmarx issue even after applying escapeSingleQuotes. Can you pls tell what should I apply to remove checkmarx issue. Here is Code public static Interaction__c ...
Shivanshu's user avatar
0 votes
1 answer
133 views

How can I rewrite this function to avoid SQL injection

I am new to Salesforce and Apex, my Java experience is ancient as well. I was trying to escape every parameter in this function but am still getting: Apex classes should escape variables merged in DML ...
Rafal's user avatar
  • 1
0 votes
2 answers
112 views

Using SOQL Injection to delete data

I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
Tom's user avatar
  • 152
-1 votes
1 answer
76 views

Is SOQL variable binding parameterization?

If you bind a variable in a SOQL query, is that equivalent to parameterization? And is there a difference in behavior between static vs dynamic?
Foo Bar's user avatar
  • 303
0 votes
1 answer
620 views

Database.query() question

Is it ok to use String.escapeSingleQuotes() inside of a database.query() or do you need to create a new variable using the String.escapeSingleQuotes() first and then use the new variable in the ...
user115415's user avatar
0 votes
1 answer
825 views

Dynamic SOQL, LIKE and Apostrophes

I want use an Aura component to perform a lookup on Accounts. For example I want to search for an Account named O'Neills. The query is: query = 'SELECT Id, Name FROM Account WHERE Name LIKE :value'; ...
windman's user avatar
  • 43
0 votes
1 answer
4k views

Lightning DOM XSS Injection Issue Reported in Checkmarx

After execution of checkmarx report we are facing injection issue for one of our aura lightning component  Issue reported :  The application's <aura:component implements="force:appHostable,...
SalesforceEnthuDev10's user avatar
-2 votes
1 answer
1k views

How to resolve SOQL injection problem in map based dynamic query in apex [closed]

I am getting SOQL injection vulnerability in security scanning in a map based dynamic query in batch apex. Please let me know if any workaround for this. Below is the code- global ChangeOwner(String ...
Gaurav Puri's user avatar
0 votes
2 answers
1k views

Bind variables in DataBase.query

I'm a little bit confused. A lot of people suggest using bind variables as params in queries to avoid having SOQL injection. Let's say we have String name = '%'; String param = '%' + name + '%'; ...
pincet's user avatar
  • 917
0 votes
0 answers
110 views

Trying to query a limit of 100 orders that are broken up into multiple records based on the item

I need some assistance with creating a query that will get all the records that correspond to the first 100 orders. For example the table looks something like this: I know I can use GROUP BY grab the ...
Jebert's user avatar
  • 15
0 votes
2 answers
1k views

Second order SOQl/SOSL injection error during checkmarx scan

I am getting SOQL injection at line originalObjectQuery += ' WHERE Id = '' + originalId + '''; How can i reslove this? public static Id close(Id originalId) { //** Build query to return the full ...
Shira's user avatar
  • 59
4 votes
2 answers
275 views

Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)

I am using a dynamic query in one of our AppExchange products. There is an LWC component within our app, which has a property called filterLogic as below: <targetConfig targets="...
Ashish's user avatar
  • 2,372
0 votes
1 answer
2k views

I have got the Exception [DEBUG|Exception: System.QueryException: Only variable references are allowed in dynamic SOQL/SOSL. ] on SOQL Query

When i have executed my code i got the exception System.QueryException: Only variable references are allowed in dynamic SOQL/SOSL. . Kindly assist me. string query3 ='select id, accountId, ...
Ankit verma's user avatar
1 vote
1 answer
1k views

Does escapeSingleQuotes esacpe backslash too?

Does escapeSingleQuotes escape backslash character too? From the document it mentions: If you must use dynamic SOQL, use the escapeSingleQuotes method to sanitize user-supplied input. This method ...
lulalala's user avatar
  • 113
0 votes
1 answer
1k views

SOQL query to get the first and last day of the current month?

i need to pass SOQL query to get the first and last day of the previous month. Example Query: Select Name, ID FROM Audit__C WHERE Audit_Month__C BETWEEN 'previous month start date (2020-04-01)' AND '...
Amudha's user avatar
  • 1
0 votes
0 answers
135 views

SOQL Injection Issue

I am working on an assignment where I need to fix a SOQL Injection issue in one of the SOQL in a batch apex. The query is below. SELECT Id, Name from Contact where (TrustName__c != null OR Status__c !...
Balaji Pooruli's user avatar
0 votes
0 answers
58 views

SOQL Injection error in the Checkmarx scanner report [duplicate]

I am facing below error: In the below Scenario, I have tested it properly but still in order to avoid the SOQL injection, But when I am running the Checkmarx I am getting error as below: public ...
Raam's user avatar
  • 1
0 votes
1 answer
407 views

SOQL Injection Prevention

In the below scenario i am Accepting the ID of object in the string form : What will be the best way to avoid the SQL injection for ASId. public static List<AB__c>ABC(string ASId) ...
Rajeeg's user avatar
  • 3
4 votes
1 answer
4k views

SOQL Query For To Get the Tabs of Particular Application

I want Soql Query for to get the tabs(Navigation Items) under one application (App) in salesforce. Suppose Application Name is Data Management under these We have Database,Table,Column tabs as Custom ...
Rabbani's user avatar
  • 43
1 vote
1 answer
63 views

Trying to solve SOQL injection vulnerability

I have followed this official guide: SOQL Injection and came up with this: String query = 'Select FirstName, LastName, Phone, Email From Contact Where '; if(String.isNotBlank(fName)) { ...
Austin Evans's user avatar
1 vote
1 answer
2k views

SFMC Data View Query

I have a query, I want to bring in all the Sends (for particular email) and opens. But in my query it only brings the matching Opens. For example email sent to 1000 subscribers and total unique opens ...
Sohail's user avatar
  • 559
0 votes
4 answers
6k views

replace ' with \' in apex code

i have string variable called "Identifier" which has apostrophe in it. example: Identifier = "string's length" i need to replace this apostrophe with "\'" the result should be Identifier = "string\'...
Sisir's user avatar
  • 111
0 votes
2 answers
111 views

Change format fields in SOQL [closed]

I do the next SOQL and works: SELECT FieldString FROM Account GROUP BY FieldString HAVING COUNT(FieldString)>1 But when I do the next SOQL doesn't work: SELECT FieldDouble FROM Account GROUP ...
Carlos Glez's user avatar
-1 votes
2 answers
2k views

Query: SOQL SOSL Injection in Security Review

While passing the app, I am still getting SOQL Injection errors in checkmarx. Please advise why this is: L 435: query += fmw.LeadFieldName + ', '; L 437: query = query.substring(0 , query.length()-2)...
Salesforce Things's user avatar
0 votes
1 answer
317 views

How to find duplicate records for master record

I have 3 (A,B,C) objects they are A-master B-Junction object and C master of B object, B object has the Master detail relationship with A and B objects. When the records created for B due to some ...
Vivek P's user avatar
  • 197
0 votes
1 answer
1k views

Dynamic soql picklist binding in WHERE clause

I have an auraenabled method in my lightning controller apex class. My requirement is that when user selects a picklist value of status__c and/or mode_of_travel__c as a filter and click on apply then ...
Meena's user avatar
  • 57
0 votes
3 answers
231 views

Where is my dynamic SQOL query is vulnerable?

I'd like to better understand which parts of dynamic SOQL can be vulnerable. I have a query: Database.query( ' SELECT ' + queryFieldNameFromUserInput + ' FROM ' + objectNameFromUserInput ...
Mikhail Ivanov's user avatar
1 vote
1 answer
1k views

Soql Injection in dynamic query in checkmarx Scanner report

My Apex class for dynamic query is if(!String.isEmpty(SearchGrpName)) SearchGrpNum = '\'%' + String.escapeSingleQuotes(GrpNumZ.trim()) + '%\''; whereClause += 'Accountnumber like ' +SearchGrpNum+' ...
Eagerin Sf's user avatar
  • 1,085
4 votes
2 answers
5k views

Bind a List variable in a Dynamic SOQL Query

Code 1 List<String> accNameList = new List<String>{'Acc1','Acc2','Acc3'}; List<Account> accountList = Database.query('SELECT Id FROM Account WHERE Name IN:accNameList'); Code 2 ...
benahm's user avatar
  • 2,627
4 votes
2 answers
419 views

PHP Salesforce Toolkit Parameterized Queries/ SQL Injection Prevention

Using the Salesforce PHP Toolkit how can we safely execute queries? It doesn't seem like parameterized queries are supported. The only function I've seen is query() and that only takes in an SOQL with ...
chris85's user avatar
  • 65
4 votes
2 answers
3k views

Prevent SOQL Injection in Your Code

I am stuck on the prevent SOQL injection trailhead, where I am looking to determine which portions of the code I would need to invoke escapeSingleQuotes or whitelist to enable. I've made several ...
Medhanie Habte's user avatar
4 votes
1 answer
2k views

How to avoid SOQL/SOSL Injection security review issue?

I am facing following security review issue. I am getting SOQL/SOSL security review issue for the below format of code: String whereclause -> name = 'test'; //assume whereclause entered by user ...
Riya's user avatar
  • 71
1 vote
1 answer
4k views

countQuery() returns System.QueryException: unexpected token: ':'

Scenario: While updating some code to satisfy SOQL injection issues brought up by security review report, I stumbled across a code that was not brought up. I thought it was similar to the code in the ...
Bryan's user avatar
  • 427
3 votes
1 answer
647 views

SOQL Injection protection

I'm facing an issue on code scanning. The following code has second order error. TestList = [SELECT Id, name, address FROM Object__c where Id IN: TestIddSet]; TestList is a list of the Object__c. ...
MnZ's user avatar
  • 3,170
1 vote
1 answer
1k views

SOQL join between custom related Objects and standard Objects

I have to retrive datas from 2 custom object and sobject Product2, Object details as follows, object name :delv__dftly_Delivery_Checkouts__r Field name API Name Data type ...
Chandu's user avatar
  • 163
0 votes
1 answer
6k views

Dynamic Query String Where clause concatenation

I am newbie & trying to create a dynamic querystring on the basis of some conditions, & even when it does not satisfies any condition, the query should be able to run properly with where ...
Coder's user avatar
  • 377
2 votes
0 answers
164 views

Preventing SOQL injection when using AJAX toolkit

How can we prevent SOQL injection when using AJAX toolkit while querying records using sforce library. For e.g if there is a query written as below var result = sforce.connection.query("select name, ...
anmrk's user avatar
  • 813
4 votes
2 answers
1k views

How to fetch profileName and permssionSets assigned to the all active users based on profile name

Requirement:I need to fetch a data with username with profileName and permission Sets assigned to users based on profile. Here I have written a Query for fetching user. Below is the query select ...
ajay bagdad's user avatar
0 votes
1 answer
2k views

no viable alternative at character '\' dynamic soql issue

I have below method which gets called from page by supplying the search keywords: public PageReference runIntermediariesSearch() { soql = intermediariesSoql + ' where Name != null '; if (...
sunny's user avatar
  • 1,387
1 vote
2 answers
2k views

SOQL Injection Solutions Help - (Used esacapeSingleQuotes(str) - gives error = no viable alternative at character '\' )

I am facing some issues with following SOQL Query : My Scanner result gave me SOQL Injection Errors, can anyone help in fixing those - I am going throw lots of Google Search and Stuff, but it will ...
Salesforce Steps's user avatar
0 votes
1 answer
933 views

how to Query parent to child

I have process in salesforce in such a way opportunity we can relate this opportunity to this lookup field parent_opportunity__c . Which relates opportunity to other parent opportunity. I want to ...
Karthika Ram's user avatar
2 votes
1 answer
2k views

Getting SOQL/SOSL Injection error when I send my code for security review

I have send my code for security review I am getting error for SOQL/SOSL Injection. I have made the changes on the bases they have mention in report. But even I am getting issue with dynamic soql I am ...
Anu's user avatar
  • 3,879
4 votes
1 answer
729 views

JSforce security features?

How can we avoid SOQL injection in JSforce code if we are using connection method to achieve connection and then further using SOQL. Is it not having SOQL in javascript not good practice? I am just ...
Manju's user avatar
  • 558
0 votes
1 answer
188 views

Dynamic SOQL - Risks/Impacts

I understand SOQL is a much restricted version of SQL but what are the potential risks associated with using dynamic SOQL? What damage could be done with malicious intent through it? I'm just trying ...
Girbot's user avatar
  • 5,530
3 votes
1 answer
785 views

SOQL injection in dynamic query

I am facing soql injection issue in my dynamic query, i have done with sting.escapesinglequotes() also but still facing this issue. here is my code. query: query = 'select id,Name,Owner.Id from ' + ...
user7374's user avatar
1 vote
1 answer
734 views

SOQL Injection Error in Checkmarx Scanner Report

I have a query similar to this in one of our apps, List<Account> accountList = Database.query('SELECT Id,Name FROM Account WHERE Id IN:accIds'); But Checkmarx always gives SOQL Injection ...
anmrk's user avatar
  • 813
0 votes
1 answer
688 views

How to fix the vulnerable to SOQL injection attacks error in Salesforce?

In my Custom Visualforce page U have coded an iframe like this: $("a#icsFrame8").click(function () { document.getElementById("myIFrame").src = '/apex/Samplepage?isdtp=mn'; But, After we did a ...
fsales572's user avatar
  • 321