Salesforce Platform Developer I Certification Guide

Whitelisting

Check the input of the value to what a user may input to your form. You can probably solve that issue with the replacement of a text field into a picklist, or validate what a user may input in your text field.

In the following example, I check if the parameter contains the OR or AND operators. If so, the code will not execute the query but will define an error on my page:

String sInput = Apexpages.currentPage().getParameters().get('textInput');if (sInput.containsIgnoreCase(' AND ') || (sInput.containsIgnoreCase(' OR '))){ // return an error} else { // execute query}

You can do the same action with the +- sign or the =- sign. Put all your forbidden words and characters in a set and check if the characters are present. In combination ...