SOQL Injection

Executing SOQL queries with data from untrusted sources may allow access to unauthorized data.

The Salesforce Object Query Language (SOQL) is intended to retrieve specific information from the application database; one cannot change such data using SOQL queries.

Salesforce Object Query Language (SOQL) injection errors occur when:

1. Data enters a program from an untrusted source.


2. The data is used to dynamically construct a SOQL query without any pre-processing or sanitization.
Example 1: The following code dynamically constructs and executes a SOQL query that searches for contacts with a specified name.

...
public String inputValue {
  get { return inputValue; }
  set { inputValue = value; }
}
...
String queryString = 'SELECT Id FROM Contact WHERE (IsDeleted = false AND Name like \'%' + inputValue + '%\')';
result = Database.query(queryString);
...

This code intends to execute the query as follows:

SELECT Id FROM Contact WHERE (IsDeleted = false AND Name like '%inputValue%')

However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if inputValue does not contain a single-quote character. If an attacker enters the string name') OR (Name like '% for inputValue, then the query becomes the following:

SELECT Id FROM Contact WHERE (IsDeleted = false AND Name like '%name') OR (Name like '%%')

The addition of the name') OR (Name like '% condition causes the where clause to use the LIKE '%%' condition, which will force the query to output all possible ID values, since it becomes logically equivalent to the much simpler query:

SELECT Id FROM Contact WHERE ... OR (Name like '%%')

Unlike most of database interfaces, SOQL in the force.com platform does not support multiple SOQL statements separated by semicolons, which means that it is not possible to concatenate several commands in a single query as is the case with regular SQL injection attacks. Also, note that Apex database does not support comments, so every single quote, parenthesis or other special character must be paired.