FAQ-001619 - SQL Injection and Input Validation / Security Review and Vulnerability Assessment

To address SQL injection vulnerabilities identified in security scans, developers should: 1. **Use Bind Variables**: Incorporate bind variables in SOQL/SOSL queries to securely handle user inputs and prevent direct concatenation of user input. 2. **Sanitize Inputs**: Apply the `String.escapeSingleQuotes()` method to sanitize all string inputs, preventing malicious input from being executed as part of a query. Escape special characters in user inputs to maintain query integrity. 3. **Review Dynamic Queries**: Examine the code for any dynamic query usage and ensure proper input sanitization is applied. 4. **Whitelist Validation**: Validate user inputs against a whitelist of acceptable values, especially for object or field names, using methods like `Schema.getGlobalDescribe()`. 5. **Enforce Permissions**: Ensure object and field-level permissions are enforced in Apex controllers. Use `WITH USER_MODE` in SOQL queries or `AccessLevel.USER_MODE` for Database methods to automatically enforce permissions. Alternatively, use security-enforced methods or explicitly check user permissions. 6. **Avoid Unsafe Dynamic Queries**: Refrain from constructing SOQL queries dynamically with user-supplied data unless proper validation and sanitization are applied. 7. **Thorough Testing**: Use tools like SFDX scanner to test the application and address any remaining vulnerabilities before submission. These practices help mitigate SQL injection risks effectively and secure your application.

The FAQ content is largely accurate but needs minor improvements for clarity and modern best practices. Changes made: 1) Added parentheses to `String.escapeSingleQuotes()` to properly indicate it's a method call. 2) Updated the permissions enforcement section (point 5) to lead with modern approaches (`WITH USER_MODE` and `AccessLevel.USER_MODE`) while maintaining that legacy approaches remain valid, following the security approaches guidelines. The three selected security rules directly relate to this FAQ's content: ApexSOQLInjection is the primary rule for detecting SOQL injection vulnerabilities that this FAQ addresses. The FAQ's points about bind variables, input sanitization, and avoiding unsafe dynamic queries directly relate to what this rule detects. ApexCRUDViolation relates to point 5 about enforcing object and field-level permissions, which this rule helps detect when missing. ApexSharingViolations relates to the broader security context of enforcing proper access controls mentioned in point 5, as sharing violations are part of comprehensive permission enforcement.