💬 In plain words: Salesforce Object Query Language ( SOQL ) injection happens when you glue raw user input directly into a query string, allowing the user's text to change the logic of the query itself. Your strongest defense is using bind variables ( :userInput ), which force Salesforce to treat input strictly as data—never as executable code. For dynamic queries, your next best tools are Database.queryWithBinds , allow-listing field names, and using String.escapeSingleQuotes as a last resort. 📌 Quick Example: Imagine writing String query = 'SELECT Id FROM Account WHERE Name LIKE \'' + userInput + '\''; . If a user types xyz' OR Name != ' into the search box, your query rewrites itself to return every single Account in the database. The fix is simple: use WHERE Name LIKE :searchTerm . Because it is a bind variable, that malicious text is just searched literally and can never become part of the query structure. ...
Salesforce Basics