ApexAdvancedsecuritysoqldynamic
Secure dynamic SOQL with bind variables and field allowlists
Real World Scenario
Admin-configured report LWC builds dynamic SOQL from user filter input. Security review flags SQL injection via unsanitized field names.
Expected Answer
• Bind variables for all user values: WHERE Status__c = :statusFilter
• Field allowlist from Custom Metadata—not user-provided field API names
• EscapeSOSL for SOSL search terms not SOQL concatenation
• with sharing on controller; stripInaccessible on results
• Reject query if allowlist validation fails before execution
• Audit log dynamic queries with user Id and filter snapshot
• PMD ApexSOQLInjection rule in CI on dynamic query builders
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. Bind variables for all user values: WHERE Status__c = :statusFilter. Field allowlist from Custom Metadata—not user-provided field API names. Pick based on your integration pattern and team capability. Dynamic SOQL without allowlist is injection vector—metadata-driven field sets only. Optimize for scale and operational observability.
Architect Perspective
Dynamic SOQL without allowlist is injection vector—metadata-driven field sets only.