Questions tagged [soql-injection]

SOQL injection involves taking user-supplied input and using those values in a dynamic SOQL query. If the input is not validated, it can include SOQL commands that effectively modify the SOQL statement and trick the application into performing unintended commands.

1
vote
1answer
28 views

SFMC Data View Query

I have a query, I want to bring in all the Sends (for particular email) and opens. But in my query it only brings the matching Opens. For example email sent to 1000 subscribers and total unique opens ...
0
votes
3answers
95 views

replace ' with \' in apex code

i have string variable called "Identifier" which has apostrophe in it. example: Identifier = "string's length" i need to replace this apostrophe with "\'" the result should be Identifier = "string\'...
0
votes
2answers
34 views

Change format fields in SOQL [closed]

I do the next SOQL and works: SELECT FieldString FROM Account GROUP BY FieldString HAVING COUNT(FieldString)>1 But when I do the next SOQL doesn't work: SELECT FieldDouble FROM Account GROUP ...
-1
votes
2answers
297 views

Query: SOQL SOSL Injection in Security Review

While passing the app, I am still getting SOQL Injection errors in checkmarx. Please advise why this is: L 435: query += fmw.LeadFieldName + ', '; L 437: query = query.substring(0 , query.length()-2)...
0
votes
1answer
79 views

How to find duplicate records for master record

I have 3 (A,B,C) objects they are A-master B-Junction object and C master of B object, B object has the Master detail relationship with A and B objects. When the records created for B due to some ...
0
votes
1answer
345 views

Dynamic soql picklist binding in WHERE clause

I have an auraenabled method in my lightning controller apex class. My requirement is that when user selects a picklist value of status__c and/or mode_of_travel__c as a filter and click on apply then ...
0
votes
3answers
172 views

Where is my dynamic SQOL query is vulnerable?

I'd like to better understand which parts of dynamic SOQL can be vulnerable. I have a query: Database.query( ' SELECT ' + queryFieldNameFromUserInput + ' FROM ' + objectNameFromUserInput ...
0
votes
1answer
215 views

Soql Injection in dynamic query in checkmarx Scanner report

My Apex class for dynamic query is if(!String.isEmpty(SearchGrpName)) SearchGrpNum = '\'%' + String.escapeSingleQuotes(GrpNumZ.trim()) + '%\''; whereClause += 'Accountnumber like ' +SearchGrpNum+' ...
4
votes
2answers
2k views

Bind a List variable in a Dynamic SOQL Query

Code 1 List<String> accNameList = new List<String>{'Acc1','Acc2','Acc3'}; List<Account> accountList = Database.query('SELECT Id FROM Account WHERE Name IN:accNameList'); Code 2 ...
3
votes
2answers
169 views

PHP Salesforce Toolkit Parameterized Queries/ SQL Injection Prevention

Using the Salesforce PHP Toolkit how can we safely execute queries? It doesn't seem like parameterized queries are supported. The only function I've seen is query() and that only takes in an SOQL with ...
4
votes
2answers
2k views

Prevent SOQL Injection in Your Code

I am stuck on the prevent SOQL injection trailhead, where I am looking to determine which portions of the code I would need to invoke escapeSingleQuotes or whitelist to enable. I've made several ...
4
votes
1answer
412 views

How to avoid SOQL/SOSL Injection security review issue?

I am facing following security review issue. I am getting SOQL/SOSL security review issue for the below format of code: String whereclause -> name = 'test'; //assume whereclause entered by user ...
1
vote
1answer
1k views

countQuery() returns System.QueryException: unexpected token: ':'

Scenario: While updating some code to satisfy SOQL injection issues brought up by security review report, I stumbled across a code that was not brought up. I thought it was similar to the code in the ...
2
votes
1answer
321 views

SOQL Injection protection

I'm facing an issue on code scanning. The following code has second order error. TestList = [SELECT Id, name, address FROM Object__c where Id IN: TestIddSet]; TestList is a list of the Object__c. ...
1
vote
1answer
676 views

SOQL join between custom related Objects and standard Objects

I have to retrive datas from 2 custom object and sobject Product2, Object details as follows, object name :delv__dftly_Delivery_Checkouts__r Field name API Name Data type ...
0
votes
1answer
3k views

Dynamic Query String Where clause concatenation

I am newbie & trying to create a dynamic querystring on the basis of some conditions, & even when it does not satisfies any condition, the query should be able to run properly with where ...
2
votes
0answers
98 views

Preventing SOQL injection when using AJAX toolkit

How can we prevent SOQL injection when using AJAX toolkit while querying records using sforce library. For e.g if there is a query written as below var result = sforce.connection.query("select name, ...
3
votes
2answers
538 views

How to fetch profileName and permssionSets assigned to the all active users based on profile name

Requirement:I need to fetch a data with username with profileName and permission Sets assigned to users based on profile. Here I have written a Query for fetching user. Below is the query select ...
0
votes
1answer
893 views

no viable alternative at character '\' dynamic soql issue

I have below method which gets called from page by supplying the search keywords: public PageReference runIntermediariesSearch() { soql = intermediariesSoql + ' where Name != null '; if (...
1
vote
2answers
670 views

SOQL Injection Solutions Help - (Used esacapeSingleQuotes(str) - gives error = no viable alternative at character '\' )

I am facing some issues with following SOQL Query : My Scanner result gave me SOQL Injection Errors, can anyone help in fixing those - I am going throw lots of Google Search and Stuff, but it will ...
0
votes
1answer
218 views

how to Query parent to child

I have process in salesforce in such a way opportunity we can relate this opportunity to this lookup field parent_opportunity__c . Which relates opportunity to other parent opportunity. I want to ...
2
votes
1answer
1k views

Getting SOQL/SOSL Injection error when I send my code for security review

I have send my code for security review I am getting error for SOQL/SOSL Injection. I have made the changes on the bases they have mention in report. But even I am getting issue with dynamic soql I am ...
3
votes
1answer
259 views

JSforce security features?

How can we avoid SOQL injection in JSforce code if we are using connection method to achieve connection and then further using SOQL. Is it not having SOQL in javascript not good practice? I am just ...
0
votes
1answer
76 views

Dynamic SOQL - Risks/Impacts

I understand SOQL is a much restricted version of SQL but what are the potential risks associated with using dynamic SOQL? What damage could be done with malicious intent through it? I'm just trying ...
3
votes
1answer
232 views

SOQL injection in dynamic query

I am facing soql injection issue in my dynamic query, i have done with sting.escapesinglequotes() also but still facing this issue. here is my code. query: query = 'select id,Name,Owner.Id from ' + ...
1
vote
1answer
290 views

SOQL Injection Error in Checkmarx Scanner Report

I have a query similar to this in one of our apps, List<Account> accountList = Database.query('SELECT Id,Name FROM Account WHERE Id IN:accIds'); But Checkmarx always gives SOQL Injection ...
0
votes
1answer
500 views

How to fix the vulnerable to SOQL injection attacks error in Salesforce?

In my Custom Visualforce page U have coded an iframe like this: $("a#icsFrame8").click(function () { document.getElementById("myIFrame").src = '/apex/Samplepage?isdtp=mn'; But, After we did a ...
1
vote
2answers
547 views

SOQL_SOSL Injection Issue Solution

Here I have done get;set; with "selectedEvent" which is a selected value of the Picklist, which can be TODAY, THIS_WEEK, THIS_MONTH or NEXT_MONTH which are standard things which I can use in SOQL to ...
2
votes
1answer
2k views

SOQL done right. SOQL-Injection secure

I was looking for some reassurance that all that needs to be done (and its best practice) when doing dynamic SOQL is to use escapeSingleQuotes. There was a query like this string query = 'SELECT ' + ...