🔐 Preventing SOQL Injection in Apex: Secure Your Queries
🔍 What is SOQL Injection? SOQL injection happens when an attacker enters harmful input into your application to trick a SOQL query into doing something it shouldn’t—like returning unauthorized data or changing logic. This usually happens when user input is added directly into a dynamic query without validation. 💥 Example of Unsafe Code public static List<Contact> unsafeSearch(String searchKey) { String query = 'SELECT Id FROM Contact WHERE Name = \'' + searchKey + '\''; return Database.query(query); } Why it’s unsafe: In this code, the user input (searchKey) is added directly into the query string without any checks or cleaning. If a user types something like: 'John%' OR Name != ' ' The final query becomes: SELECT Id FROM Contact WHERE Name = 'John%' OR Name != ' ' This means: Instead of searching for contacts whose name is like “John%”. The query now says: “Give me contacts where the name is ‘John%’ OR where the...
