FAQ-001591 - SQL Injection and Input Validation / Dynamic SOQL Query Construction

To securely handle dynamic SOQL when standard binding isn't possible for SObject or field names, you can follow these best practices: 1. **Validate SObject Names**: Use `Schema.getGlobalDescribe()` to get a map of all SObject names and ensure the user-supplied object name exists in the schema. 2. **Validate Field Names**: Retrieve the field map using `getDescribe()` on the SObject and validate the user-supplied field name against this map. 3. **Sanitize Inputs**: Avoid using raw user input in SOQL queries. Use methods like `String.escapeSingleQuotes()` for sanitizing simple string comparisons. 4. **Check Permissions**: Implement proper CRUD (Create, Read, Update, Delete) and FLS (Field-Level Security) checks to ensure the user has the necessary permissions for the specified object or field. 5. **Use `with SECURITY_ENFORCED`**: Include this clause in SOQL queries to enforce field- and object-level security automatically. 6. **Programmatic Query Construction**: Use `sObjectType` or `sObjectFields` to construct queries programmatically, avoiding raw strings. These steps help prevent SOQL injection and unauthorized data access when traditional bind variables cannot be used for object and field names.