Apex Development

💬 In plain words: Salesforce Object Query Language ( SOQL ) injection happens when you glue raw user input directly into a query string, allowing the user's text to change the logic of the query itself. Your strongest defense is using bind variables ( :userInput ), which force Salesforce to treat input strictly as data—never as executable code. For dynamic queries, your next best tools are Database.queryWithBinds , allow-listing field names, and using String.escapeSingleQuotes as a last resort. 📌 Quick Example: Imagine writing String query = 'SELECT Id FROM Account WHERE Name LIKE \'' + userInput + '\''; . If a user types xyz' OR Name != ' into the search box, your query rewrites itself to return every single Account in the database. The fix is simple: use WHERE Name LIKE :searchTerm . Because it is a bind variable, that malicious text is just searched literally and can never become part of the query structure. ...

💬 In plain words: The @RestResource annotation turns a regular Apex class into your own custom REST API endpoint inside Salesforce. You get full control over the URL path, the HTTP methods ( GET , POST , PATCH ), and the exact JSON structure. You should build a custom @RestResource API when standard Salesforce REST APIs require too many separate network calls or when you need to run custom business logic before saving data. Always remember: your code runs using the permissions of the external user calling the API, so their sharing rules and field security apply! 🎬 Real-Life Story: The Orders That Arrived Twice A company's ERP billing system was set up to send new customer orders to a custom Salesforce @RestResource endpoint. Whenever the internet connection hiccuped, the ERP didn't receive a success message in time, so it automatically sent the exact same order a second time. Because the Salesforce developer used a basic insert statement in Ape...

💬 In plain words: These three keywords tell Apex whose eyes to use. with sharing respects the running user's record access. without sharing acts like God mode to see everything. inherited sharing copies whatever the caller was using. Default habit: use with sharing , and go without only on purpose. 📌 Example: An invoice service class marked with sharing returns only invoices Asha can see. A nightly stats job marked without sharing counts ALL invoices on purpose (and documented). A shared utility class marked inherited sharing behaves like whoever called it. 🎬 Real-Life Example: The Component That Leaked Other Drivers' Parcels A "My Deliveries" Lightning Web Component (LWC) goes live. A driver scrolls past his own list—and keeps scrolling into everyone else's deliveries. The Old/Bad Way: The Apex controller class had no sharing keyword. Depending on how it was entered, it ran in system context, ignori...