Option A:
String query = 'SELECT Id FROM Account WHERE Name LIKE \'%' + String.escapeSingleQuotes(name) + '%\''; List<Account> results = Database.query(query); Reference:
Why Safe: By escaping single quotes, it mitigates the risk of SOQL injection attacks that rely on manipulating string literals.
Option C:
String query = '%' + name + '%';
List<Account> results = [SELECT Id FROM Account WHERE Name LIKE :name]; Why Safe: Bind variables are the recommended way to include user input in SOQL queries safely, as they prevent injection by treating the input as a parameter rather than part of the query string.
Option B:
String query = 'SELECT Id FROM Account WHERE Name LIKE \'%' + name.noQuotes() + '%\''; List<Account> results = Database.query(query); Why Unsafe: Without proper sanitization, the name variable could contain malicious SOQL code, leading to injection vulnerabilities.
Option D:
String query = 'SELECT Id FROM Account WHERE Name LIKE \'%' + name + '%\''; List<Account> results = Database.query(query); Why Unsafe: Direct concatenation of user input without sanitization leaves the application vulnerable to SOQL injection attacks.
Conclusion:
Safe Options: A and C are safe from SOQL injection because they properly handle user input through escaping and bind variables, respectively.
Unsafe Options: B and D are unsafe as they do not adequately prevent SOQL injection.