Bind Variables

💬 In plain words: Salesforce Object Query Language ( SOQL ) injection happens when you glue raw user input directly into a query string, allowing the user's text to change the logic of the query itself. Your strongest defense is using bind variables ( :userInput ), which force Salesforce to treat input strictly as data—never as executable code. For dynamic queries, your next best tools are Database.queryWithBinds , allow-listing field names, and using String.escapeSingleQuotes as a last resort. 📌 Quick Example: Imagine writing String query = 'SELECT Id FROM Account WHERE Name LIKE \'' + userInput + '\''; . If a user types xyz' OR Name != ' into the search box, your query rewrites itself to return every single Account in the database. The fix is simple: use WHERE Name LIKE :searchTerm . Because it is a bind variable, that malicious text is just searched literally and can never become part of the query structure. ...

In plain words: Dynamic SOQL allows you to build database query strings on the fly in Apex code at runtime instead of hardcoding static queries. By evaluating user input, filter conditions, and runtime variables dynamically, you can pass a string query to Database.query() with native bind variables or explicit bind maps, keeping your queries flexible, secure, and immune to SOQL injection. Static SOQL queries inside square brackets (such as [SELECT Id FROM Account] ) work well when object names, select fields, and filter clauses are fixed at compile time. However, building custom search screens, configurable export utilities, or polymorphic reporting tools requires dynamic query construction based on user input. Dynamic SOQL gives Apex developers complete runtime flexibility while maintaining strict security controls.