SOQL injection involves taking user-supplied input and using those values in a dynamic SOQL query. If the input is not validated, it can include SOQL commands that effectively modify the SOQL statement and trick the application into performing unintended commands.

If you must use dynamic SOQL, use the escapeSingleQuotes method to sanitize user-supplied input.

history | excerpt history