FAQ-001613 - SQL Injection and Input Validation / Secure Implementation Documentation

To securely handle dynamic queries with client-provided parameters, follow these approved methods: 1. **Use Bind Variables**: This is the most secure approach, as it prevents input from breaking out of its quoted context and ensures user inputs are treated as data, not executable code. 2. **Sanitize Input**: If bind variables cannot be used, apply `String.escapeSingleQuotes()` to sanitize input. This ensures single quotes are treated as part of the string, not as database commands. 3. **Use APIs for Complex Queries**: For more complex client-side SOQL, use the REST or SOAP API, which safely handles SOQL calls. 4. **Avoid System Mode Execution**: Do not execute user-generated queries in Apex running in system mode. 5. **Validate Permissions**: Always validate user permissions, including object accessibility and field-level security, before executing queries. These practices help maintain security while handling dynamic queries.