Salesforce Platform Developer I Certification Guide

Escape SingleQuotes

Another, and equally highly recommended, option to mitigate SOQL injection is to escape single quotes. This prevents a user's input from being treated as code by constraining them to the boundary of the string.

We use the String.escapeSingleQuotes() function to add a backslash before every single quote in the parameters.

If you execute the following code in your developer console, you will see the difference in your query:

String sString = 'This is a \'Single Quote\' test';String sEscapedString = String.escapeSingleQuotes(sString);System.debug(sString); // this returns the string "This is a 'Single Quote' test"System.debug(sEscapedString); // this returns the string "This is a \'Single Quote\' test"