SOQL injection is a vulnerability that occurs when user-supplied input is used to construct a dynamic SOQL query without proper validation or escaping. This can allow an attacker to modify the query and execute unintended commands or access unauthorized data. To prevent SOQL injection, it is recommended to use static queries with bind variables or use the escapeSingleQuotes method to sanitize the input. Based on the image descriptions from my tool outputs, the following options are safe from SOQL injection:
* Option A: This option uses a static query with a bind variable, which automatically escapes any malicious input and prevents it from changing the query structure. The bind variable name is obtained from an apex:inputText tag on a Visualforce page and is used as a filter for the Account Name field.
* Option C: This option also uses a static query with a bind variable, which is the same as option A. The only difference is that the bind variable name is obtained from a different apex:inputText tag on the same Visualforce page and is used as a filter for the Contact Name field.
The other options are not safe from SOQL injection because they use dynamic queries with string concatenation, which can allow an attacker to inject SOQL commands into the query string and bypass the intended logic or access unauthorized data.
References: The use of static queries with bind variables and the escapeSingleQuotes method to prevent SOQL injection can be referenced in the Salesforce Platform Developer I learning documents, specifically in modules that cover Apex security and SOQL, such as:
* SOQL Injection
* Secure Coding SQL Injection
* Apex Basics & Database