Avoiding SOQL injection vulnerabilities

It is a common use case to want to receive some user input and use this as part of a SOQL query filter. However, while this provides helpful user functionality, it can be misused by a malicious user to gain access to additional data that is not meant to be visible to them.

For example, we could be searching for a contact record with the last name in the form of an input string we have defined, as shown in the following code snippet:

public String searchName {get; set;}
public List<Contact> cons {get; private set;}
public PageReference search() {
    cons = Database.query('SELECT Id, FirstName, LastName, Email FROM 
      Contact WHERE LastName Like \'%' + searchName + '%\'');
    return null;
}

In this preceding code snippet, we are defining a dynamic SOQL query where, when the user enters a search term—for example, Smith&...