FAQ-001582 - SQL Injection and Input Validation / Application-Level Security Concerns

To address SOQL injection concerns in flexible lookup components and application-accessible code with dynamic WHERE clauses: 1. **Use Bind Variables**: Safely include user-supplied input in the query by using bind variables to ensure input is treated as data, not executable code. 2. **Sanitize Input**: If bind variables can't be used, sanitize the input with methods like `String.escapeSingleQuotes()` to prevent breaking out of its quoted context. 3. **Validate Input**: Check the input against a whitelist of acceptable values. For example, use `Schema.getGlobalDescribe()` to ensure object or field names are valid and accessible. 4. **Limit User Input**: Avoid allowing users to supply portions of the SOQL query beyond object names, field names, and WHERE clause inputs. 5. **Avoid User-Generated Queries**: Avoid executing user-generated queries in Apex, as they run in system mode. If dynamic queries are necessary, ensure proper input validation and sanitization. 6. **Use APIs for Complex Scenarios**: For more complex cases, consider using the REST or SOAP API to safely execute SOQL calls. 7. **Validate Permissions**: Always validate user permissions for objects and fields before executing queries. These steps help ensure your queries are secure and protected from injection attacks while maintaining the flexibility needed for dynamic components.

The FAQ is well-structured and covers the essential security practices for preventing SOQL injection. I made one minor correction, changing 'sanitation' to 'sanitization' in point 5 for proper terminology. The ApexSOQLInjection rule directly applies because this FAQ specifically addresses SOQL injection prevention techniques. The FAQ content covers the exact security concerns that the ApexSOQLInjection rule is designed to detect - dynamic SOQL queries with user input that could lead to injection vulnerabilities. The recommendations in the FAQ (bind variables, input sanitization, validation, limiting user input) are all standard practices for preventing the security issues that this PMD rule identifies.