**Security Risks:**
Performing DML operations on component load is a security risk because it can result in unintended or unauthorized data modifications without explicit user interaction. This bypasses user consent and opens the door for potential exploitation, such as triggering unauthorized changes or exposing sensitive data.
**Best Practices for Handling DML Operations:**
1. **Avoid Direct DML Operations on Load**: Do not perform direct DML operations during the component load process or initialization phase.
2. **Use User Actions**: Trigger DML operations through explicit user actions, like a button click, to ensure the operation is user-initiated and deliberate.
3. **Server-Side Logic**: Validate and process data on the server-side before executing any DML operations.
4. **Protect Sensitive Data**:
- Avoid passing sensitive data directly from the client-side to the server-side for updates
- Derive sensitive fields on the server-side
- For read operations, only include fields required by the client-side logic and UI
5. **Separate Object Instances**: Use a separate instance of the object record for updates to minimize security risks. Do not modify the object record passed as a parameter directly.
6. **Security Controls**:
- Validate user input to ensure it matches expected data type and format
- Escape user-provided content before rendering
- Enforce access checks (e.g., `isCreatable()`) before performing database operations
- Use "with sharing" classes to ensure proper access controls
7. **CSRF Protection**: Include safeguards against Cross-Site Request Forgery for state-changing operations.
8. **Secure Communication and Resources**:
- Use HTTPS or SFTP to protect data in transit
- Avoid dynamically loading third-party JavaScript or CSS from external sources
- Use static resources instead
9. **Authentication and Authorization**: Implement mechanisms to verify and control access to sensitive data or actions.
10. **Secure Asynchronous Operations**: Use encrypted tokens for operations like queries or updates after record creation, and validate these tokens.
These practices help ensure secure and controlled handling of DML operations while maintaining functionality and mitigating CSRF risks.