#SalesforceDaily Your Daily Tip - 45

#Trailblazer - Sahil Jain

Category - Salesforce Apex

Tip - Avoid SOQL Injection: In dynamic queries, it is recommended and a best practice to bind the dynamic variable using bind expression (=:) within the string instead of referencing it directly. This avoids all the chances of SOQL Injection.

E.g.:

String dynamicVar=:(Value set from UI)

1. Recommended way:

String dynamicQuery = 'SELECT Id, Name FROM Account WHERE Name LIKE =:dynamicVar';

2. Strict No-No:

String dynamicQuery = 'SELECT Id, Name FROM Account WHERE Name LIKE' + dynamicVar;

Submit your #Salesforce Tip!

http://bit.ly/SalesforceDaily

@Akash Mishra @Pritam Shekhawat @Vipul Goel 

Follow Previous Missed Tips: http://salesforcedaily.in #SalesforceOhana