Introduction

Visualforce pages often accept user input through text fields, parameters, or URL values. If this input is directly used in SOQL queries without validation, attackers can manipulate the query and gain unauthorized access to data.

This type of vulnerability is called SOQL Injection. Preventing SOQL injection is a mandatory security requirement in Salesforce exams, security reviews, and real-world enterprise projects.

What is SOQL Injection?

SOQL injection occurs when untrusted user input is dynamically added to a SOQL query, allowing the query logic to be altered.

● Occurs in dynamic SOQL
● Exploits unvalidated user input
● Can expose sensitive records
● Can bypass intended filters

Why SOQL Injection is Dangerous

SOQL injection is dangerous because it:

● Exposes unauthorized data
● Breaks application security
● Violates Salesforce security standards
● Can lead to security review failure
● Is commonly tested in exams

Example of Vulnerable Code (DO NOT USE)

Unsafe Dynamic SOQL Example

String nameParam = ApexPages.currentPage().getParameters().get('name');
String query = 'SELECT Id, Name FROM Account WHERE Name = \'' + nameParam + '\'';
List<Account> accList = Database.query(query);

● User input is directly concatenated
● Query can be manipulated
● Highly insecure

How Attack Happens

If user enters input like:

● ' OR Name != ''

The query logic changes and returns unintended records.

Using Bind Variables (Best Practice)

Bind variables automatically escape user input and prevent SOQL injection.

Secure Static SOQL Example

String nameParam = ApexPages.currentPage().getParameters().get('name');

List<Account> accList = [
    SELECT Id, Name
    FROM Account
    WHERE Name = :nameParam
];

● User input is safely handled
● Query logic cannot be altered
● Recommended approach

Using Bind Variables in Dynamic SOQL

Bind variables can also be used in dynamic queries.

Secure Dynamic SOQL Example

String nameParam = ApexPages.currentPage().getParameters().get('name');
String query = 'SELECT Id, Name FROM Account WHERE Name = :nameParam';

List<Account> accList = Database.query(query);

● Prevents injection
● Allows flexible query building
● Safe for real projects

Validating User Input

Input validation adds an extra layer of security.

● Restrict input length
● Allow only expected characters
● Reject unexpected patterns
● Use validation logic

Example concept:

● Only allow alphanumeric values
● Avoid free-text where possible

Avoiding Dynamic SOQL When Possible

Dynamic SOQL increases security risk.

● Use static SOQL whenever possible
● Use dynamic SOQL only when required
● Keep dynamic queries simple
● Always use bind variables

Using EscapeSingleQuotes (Limited Use)

String.escapeSingleQuotes() can help, but it is not the best solution alone.

String safeInput = String.escapeSingleQuotes(userInput);

● Helps escape quotes
● Not a replacement for bind variables
● Use only when bind variables are not possible

Real Project Example (Very Important)

Business Scenario

A Visualforce search page allows users to search Accounts by name.

Secure Apex Controller Example

public with sharing class AccountSearchController {

    public String searchName { get; set; }
    public List<Account> results { get; set; }

    public void search() {
        results = [
            SELECT Id, Name
            FROM Account
            WHERE Name LIKE :('%' + searchName + '%')
        ];
    }
}

● Uses bind variables
● Safe user input handling
● Real-world secure implementation

SOQL Injection vs SOSL Injection

Key differences include:

● SOQL injection affects SOQL queries
● SOSL injection affects SOSL searches
● Both require input validation
● Both are prevented using bind variables

Common Mistakes Developers Make

● Concatenating user input in queries
● Overusing dynamic SOQL
● Trusting URL parameters
● Skipping input validation

Best Practices

Follow these best practices to prevent SOQL injection:

● Always use bind variables
● Avoid string concatenation in queries
● Validate user input
● Prefer static SOQL
● Review queries during security testing

Exam Key Points to Remember

● SOQL injection occurs in dynamic queries
● Bind variables prevent injection
● Never concatenate user input
● Required for Salesforce security review

Conclusion

Preventing SOQL injection is a critical aspect of secure Visualforce and Apex development. By using bind variables, validating user input, and avoiding unsafe dynamic queries, developers can protect Salesforce data from unauthorized access. Proper SOQL security is essential for exams, real-world projects, and Salesforce compliance.

VF Page Beginner to Advance

Preventing SOQL Injection in VF Page