Questions tagged [soql-injection]
SOQL injection involves taking user-supplied input and using those values in a dynamic SOQL query. If the input is not validated, it can include SOQL commands that effectively modify the SOQL statement and trick the application into performing unintended commands.
51
questions
2
votes
2
answers
272
views
ApexSOQLInjection clarification with respect to binding of variables
I went through the trailhead module on SOQL injection, however I am not clear on below items:
Scenario 1) Is escapeSingleQuotes here needed ?
// Consider that userinput is coming from user
userinput =...
- 3,140
-2
votes
1
answer
51
views
Apex classes should escape variables merged in DML query (rule: Security-ApexSOQLInjection) - how to fix this? [duplicate]
There is one warning (mention above) in one line, please tell me how to fix?
public with sharing class VIT_CustomLookupController {
// Method to fetch lookup search result
@AuraEnabled(...
-1
votes
1
answer
37
views
SOQl Injection Checkmarx issues
I am getting SOQL Injection checkmarx issue even after applying escapeSingleQuotes. Can you pls tell what should I apply to remove checkmarx issue.
Here is Code
public static Interaction__c ...
0
votes
1
answer
70
views
How can I rewrite this function to avoid SQL injection
I am new to Salesforce and Apex, my Java experience is ancient as well. I was trying to escape every parameter in this function but am still getting:
Apex classes should escape variables merged in DML ...
- 1
0
votes
2
answers
57
views
Using SOQL Injection to delete data
I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; ...
- 153
-1
votes
1
answer
53
views
Is SOQL variable binding parameterization?
If you bind a variable in a SOQL query, is that equivalent to parameterization?
And is there a difference in behavior between static vs dynamic?
- 286
0
votes
1
answer
426
views
Database.query() question
Is it ok to use String.escapeSingleQuotes() inside of a database.query() or do you need to create a new variable using the String.escapeSingleQuotes() first and then use the new variable in the ...
- 11
0
votes
1
answer
518
views
Dynamic SOQL, LIKE and Apostrophes
I want use an Aura component to perform a lookup on Accounts. For example I want to search for an Account named O'Neills.
The query is:
query = 'SELECT Id, Name FROM Account WHERE Name LIKE :value';
...
- 43
0
votes
1
answer
3k
views
Lightning DOM XSS Injection Issue Reported in Checkmarx
After execution of checkmarx report we are facing injection issue for one of our aura lightning component
Issue reported :
The application's <aura:component
implements="force:appHostable,...
-2
votes
1
answer
985
views
How to resolve SOQL injection problem in map based dynamic query in apex [closed]
I am getting SOQL injection vulnerability in security scanning in a map based dynamic query in batch apex. Please let me know if any workaround for this. Below is the code-
global ChangeOwner(String ...
0
votes
2
answers
1k
views
Bind variables in DataBase.query
I'm a little bit confused. A lot of people suggest using bind variables as params in queries to avoid having SOQL injection. Let's say we have
String name = '%';
String param = '%' + name + '%';
...
- 837
0
votes
0
answers
85
views
Trying to query a limit of 100 orders that are broken up into multiple records based on the item
I need some assistance with creating a query that will get all the records that correspond to the first 100 orders. For example the table looks something like this:
I know I can use GROUP BY grab the ...
- 15
0
votes
2
answers
1k
views
Second order SOQl/SOSL injection error during checkmarx scan
I am getting SOQL injection at line originalObjectQuery += ' WHERE Id = '' + originalId + '''; How can i reslove this?
public static Id close(Id originalId) {
//** Build query to return the full ...
- 47
4
votes
2
answers
250
views
Security Review - False Positive for SOQL Injection - Configuration Data (Input only by System Admin User)
I am using a dynamic query in one of our AppExchange products.
There is an LWC component within our app, which has a property called filterLogic as below:
<targetConfig targets="...
- 2,362
0
votes
1
answer
1k
views
I have got the Exception [DEBUG|Exception: System.QueryException: Only variable references are allowed in dynamic SOQL/SOSL. ] on SOQL Query
When i have executed my code i got the exception System.QueryException: Only variable references are allowed in dynamic SOQL/SOSL. . Kindly assist me.
string query3 ='select id, accountId, ...
- 17
1
vote
1
answer
871
views
Does escapeSingleQuotes esacpe backslash too?
Does escapeSingleQuotes escape backslash character too?
From the document it mentions:
If you must use dynamic SOQL, use the escapeSingleQuotes method to sanitize user-supplied input. This method ...
- 113
0
votes
1
answer
1k
views
SOQL query to get the first and last day of the current month?
i need to pass SOQL query to get the first and last day of the previous month.
Example Query:
Select Name, ID
FROM Audit__C
WHERE Audit_Month__C BETWEEN 'previous month start date (2020-04-01)' AND '...
- 1
0
votes
0
answers
117
views
SOQL Injection Issue
I am working on an assignment where I need to fix a SOQL Injection issue in one of the SOQL in a batch apex. The query is below.
SELECT Id, Name from Contact where (TrustName__c != null OR Status__c !...
- 537
0
votes
0
answers
58
views
SOQL Injection error in the Checkmarx scanner report [duplicate]
I am facing below error:
In the below Scenario, I have tested it properly but still in order to avoid the SOQL injection, But when I am running the Checkmarx I am getting error as below:
public ...
- 1
0
votes
1
answer
356
views
SOQL Injection Prevention
In the below scenario i am Accepting the ID of object in the string form :
What will be the best way to avoid the SQL injection for ASId.
public static List<AB__c>ABC(string ASId)
...
- 3
4
votes
1
answer
3k
views
SOQL Query For To Get the Tabs of Particular Application
I want Soql Query for to get the tabs(Navigation Items) under one application (App) in salesforce. Suppose
Application Name is Data Management under these We have Database,Table,Column tabs as Custom ...
- 43
1
vote
1
answer
60
views
Trying to solve SOQL injection vulnerability
I have followed this official guide: SOQL Injection and came up with this:
String query = 'Select FirstName, LastName, Phone, Email From Contact Where ';
if(String.isNotBlank(fName)) {
...
- 721
1
vote
1
answer
2k
views
SFMC Data View Query
I have a query, I want to bring in all the Sends (for particular email) and opens. But in my query it only brings the matching Opens. For example email sent to 1000 subscribers and total unique opens ...
- 549
0
votes
4
answers
6k
views
replace ' with \' in apex code
i have string variable called "Identifier" which has apostrophe in it.
example: Identifier = "string's length"
i need to replace this apostrophe with "\'"
the result should be Identifier = "string\'...
- 101
0
votes
2
answers
102
views
Change format fields in SOQL [closed]
I do the next SOQL and works:
SELECT FieldString FROM Account GROUP BY FieldString HAVING COUNT(FieldString)>1
But when I do the next SOQL doesn't work:
SELECT FieldDouble FROM Account GROUP ...
-1
votes
2
answers
2k
views
Query: SOQL SOSL Injection in Security Review
While passing the app, I am still getting SOQL Injection errors in checkmarx.
Please advise why this is:
L 435: query += fmw.LeadFieldName + ', ';
L 437: query = query.substring(0 , query.length()-2)...
0
votes
1
answer
309
views
How to find duplicate records for master record
I have 3 (A,B,C) objects they are A-master B-Junction object and C master of B object, B object has the Master detail relationship with A and B objects.
When the records created for B due to some ...
- 197
0
votes
1
answer
1k
views
Dynamic soql picklist binding in WHERE clause
I have an auraenabled method in my lightning controller apex class. My requirement is that when user selects a picklist value of status__c and/or mode_of_travel__c as a filter and click on apply then ...
- 57
0
votes
3
answers
221
views
Where is my dynamic SQOL query is vulnerable?
I'd like to better understand which parts of dynamic SOQL can be vulnerable. I have a query:
Database.query(
' SELECT ' + queryFieldNameFromUserInput +
' FROM ' + objectNameFromUserInput ...
- 435
1
vote
1
answer
1k
views
Soql Injection in dynamic query in checkmarx Scanner report
My Apex class for dynamic query is
if(!String.isEmpty(SearchGrpName))
SearchGrpNum = '\'%' + String.escapeSingleQuotes(GrpNumZ.trim()) + '%\'';
whereClause += 'Accountnumber like ' +SearchGrpNum+' ...
- 1,085
4
votes
2
answers
4k
views
Bind a List variable in a Dynamic SOQL Query
Code 1
List<String> accNameList = new List<String>{'Acc1','Acc2','Acc3'};
List<Account> accountList = Database.query('SELECT Id FROM Account WHERE Name IN:accNameList');
Code 2
...
- 2,567
4
votes
2
answers
388
views
PHP Salesforce Toolkit Parameterized Queries/ SQL Injection Prevention
Using the Salesforce PHP Toolkit how can we safely execute queries? It doesn't seem like parameterized queries are supported. The only function I've seen is query() and that only takes in an SOQL with ...
- 65
4
votes
2
answers
3k
views
Prevent SOQL Injection in Your Code
I am stuck on the prevent SOQL injection trailhead, where I am looking to determine which portions of the code I would need to invoke escapeSingleQuotes or whitelist to enable. I've made several ...
- 407
4
votes
1
answer
2k
views
How to avoid SOQL/SOSL Injection security review issue?
I am facing following security review issue.
I am getting SOQL/SOSL security review issue for the below format of code:
String whereclause -> name = 'test'; //assume whereclause entered by user
...
- 71
1
vote
1
answer
3k
views
countQuery() returns System.QueryException: unexpected token: ':'
Scenario:
While updating some code to satisfy SOQL injection issues brought up by security review report, I stumbled across a code that was not brought up. I thought it was similar to the code in the ...
- 417
3
votes
1
answer
623
views
SOQL Injection protection
I'm facing an issue on code scanning. The following code has second order error.
TestList = [SELECT Id, name, address FROM Object__c where Id IN: TestIddSet];
TestList is a list of the Object__c.
...
- 3,152
1
vote
1
answer
1k
views
SOQL join between custom related Objects and standard Objects
I have to retrive datas from 2 custom object and sobject Product2,
Object details as follows,
object name :delv__dftly_Delivery_Checkouts__r
Field name API Name Data type
...
- 163
0
votes
1
answer
6k
views
Dynamic Query String Where clause concatenation
I am newbie & trying to create a dynamic querystring on the basis of some conditions, & even when it does not satisfies any condition, the query should be able to run properly with where ...
- 377
2
votes
0
answers
163
views
Preventing SOQL injection when using AJAX toolkit
How can we prevent SOQL injection when using AJAX toolkit while querying records using sforce library. For e.g if there is a query written as below
var result = sforce.connection.query("select name, ...
- 793
4
votes
2
answers
1k
views
How to fetch profileName and permssionSets assigned to the all active users based on profile name
Requirement:I need to fetch a data with username with profileName and permission Sets assigned to users based on profile.
Here I have written a Query for fetching user.
Below is the query
select ...
- 573
0
votes
1
answer
2k
views
no viable alternative at character '\' dynamic soql issue
I have below method which gets called from page by supplying the search keywords:
public PageReference runIntermediariesSearch() {
soql = intermediariesSoql + ' where Name != null ';
if (...
- 1,367
1
vote
2
answers
2k
views
SOQL Injection Solutions Help - (Used esacapeSingleQuotes(str) - gives error = no viable alternative at character '\' )
I am facing some issues with following SOQL Query :
My Scanner result gave me SOQL Injection Errors, can anyone help in fixing those -
I am going throw lots of Google Search and Stuff, but it will ...
- 2,150
0
votes
1
answer
845
views
how to Query parent to child
I have process in salesforce in such a way opportunity we can relate this opportunity to this lookup field parent_opportunity__c .
Which relates opportunity to other parent opportunity.
I want to ...
- 87
2
votes
1
answer
2k
views
Getting SOQL/SOSL Injection error when I send my code for security review
I have send my code for security review I am getting error for SOQL/SOSL Injection. I have made the changes on the bases they have mention in report. But even I am getting issue with dynamic soql I am ...
- 3,817
4
votes
1
answer
630
views
JSforce security features?
How can we avoid SOQL injection in JSforce code if we are using connection method to achieve connection and then further using SOQL. Is it not having SOQL in javascript not good practice? I am just ...
- 558
0
votes
1
answer
161
views
Dynamic SOQL - Risks/Impacts
I understand SOQL is a much restricted version of SQL but what are the potential risks associated with using dynamic SOQL? What damage could be done with malicious intent through it?
I'm just trying ...
- 5,405
3
votes
1
answer
769
views
SOQL injection in dynamic query
I am facing soql injection issue in my dynamic query, i have done with sting.escapesinglequotes() also but still facing this issue.
here is my code.
query: query = 'select id,Name,Owner.Id from ' + ...
- 31
1
vote
1
answer
705
views
SOQL Injection Error in Checkmarx Scanner Report
I have a query similar to this in one of our apps,
List<Account> accountList = Database.query('SELECT Id,Name FROM Account WHERE Id IN:accIds');
But Checkmarx always gives SOQL Injection ...
- 793
0
votes
1
answer
679
views
How to fix the vulnerable to SOQL injection attacks error in Salesforce?
In my Custom Visualforce page U have coded an iframe like this:
$("a#icsFrame8").click(function () {
document.getElementById("myIFrame").src = '/apex/Samplepage?isdtp=mn';
But, After we did a ...
- 311
2
votes
2
answers
1k
views
SOQL_SOSL Injection Issue Solution
Here I have done get;set; with "selectedEvent" which is a selected value of the Picklist, which can be TODAY, THIS_WEEK, THIS_MONTH or NEXT_MONTH which are standard things which I can use in SOQL to ...
- 2,150