Improper Neutralization of Special Elements in Data Query Logic

Property	Value
Language	apex
Severity
CWE	CWE-943: Improper Neutralization of Special Elements in Data Query Logic
OWASP	A03:2021 - Injection
Confidence Level	High
Impact Level	High
Likelihood Level	High

Description

If a dynamic query must be used,leverage nFORCE Query Builder. In other programming languages, the related flaw is known as SQL injection. Apex doesn't use SQL, but uses its own database query language, SOQL. SOQL is much simpler and more limited in functionality than SQL. The risks are much lower for SOQL injection than for SQL injection, but the attacks are nearly identical to traditional SQL injection. SQL/SOQL injection takes user-supplied input and uses those values in a dynamic SOQL query. If the input isn't validated, it can include SOQL commands that effectively modify the SOQL statement and trick the application into performing unintended commands.