Salesforce Platform Developer I Certification Guide

Replacing characters

Next, to the escape of single quotes and the bind variables, we need to check that the user didn't apply some tags or characters that are useful to take over the control of our query. Something like + or = (equalsTo character) can be used to execute the following query:

String sQuery = 'SELECT Id FROM User WHERE isActive = ' + myVariable;

If I enter the true AND Name Like '%%' value, the whole database is selected again.

I will remove the AND and Like words (and there are more than only these characters) in the query, in combination with escapeSingleQuotes, I receive a complete string, such as 'true Name \'%%\', which delivers no result (it will result in an exception).