MENU
A developer is tasked to perform a security review of the ContactSearch Apex class that exists in the system. Within the class, the developer identifies the following method as a security threat:
ist
return Database.query('SELECT Id, FirstName, LastName FROM Contact WHERE LastName Like
s'+lastName+'s'")?;
What are two ways the developer can update the method to prevent a SOQL injection attack?
Choose 2 answers
Suggested Answer: C, D
Get Premium DEX-450 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
14 comments · newest first
MA
Margot
3 days ago
Wait, can you really sanitize with escapeSingleQuotes? Sounds risky!
MA
Marge
8 days ago
B) is good, but A) is definitely the safest choice.
SA
Sabra
13 days ago
I’m not sure about option D, regex might not cover all cases.
AN
Anglea
19 days ago
Totally agree, variable binding is a must!
AL
Alyce
24 days ago
A) and B) are the best options to prevent SOQL injection.
JU
Juliana
29 days ago
C) doesn't really address SOQL injection directly.
BA
Barb
1 month ago
Using variable binding is a must for security!
FR
Francoise
1 month ago
Wait, can you really sanitize with escapeSingleQuotes? Sounds risky!
MI
Millie
1 month ago
I disagree, D) could work too if done right.
ST
Stephaine
2 months ago
A) and B) are the best options to prevent SOQL injection!
LY
Lynna
2 months ago
I recall the importance of using the with sharing keyword, but I don't think it directly prevents SOQL injection like the other options do.
KA
Kattie
2 months ago
I feel like we practiced a similar question where we had to sanitize inputs. I think option D could be useful, but it might not be as effective as binding.
AS
Ashleigh
2 months ago
I'm not entirely sure about option B. I think using escapeSingleQuotes could help, but I'm not confident it covers all cases.
SO
Socorro
2 months ago
I remember we discussed variable binding in class; I think option A is definitely a good choice to prevent SOQL injection.