Salesforce Platform Developer I Certification Guide

Use bind variables

One of the most recommended methods to mitigate SOQL injections is bind variables. You have already learned in the chapter about the SOQL statements that you can use dynamic variables in your queries.

This is what we call a bind variable. By setting the user input as a variable, you ensure that the user's input is treated as a variable and not as an executable element of the query:

Set<String> setWithStrings = new Set<String>{'test','account'};List<Account> lstAccounts = [SELECT Id, Name FROM Account WHERE Name IN :setWithStrings];

From our previous example, we will rewrite our code as follows:

String sParameter = '%' + ApexPages.currentPage().getParameters().get('YourTextfieldParam') + '%';List<Account> lstAccounts = [SELECT ...