[SalesForce] Sanitize a string before injecting it into SOSL

Is there a way through the .net framework or some other package to sanitize strings so that they can be safely used in sosl? Is there any larger standard that SOSL falls under?

I was able to find How to pass a variable to the SOQL where clause? and Escaping reserverved characters in SOSL queries, but they both deal with solving specific cases rather than a general solution.

I would prefer not to roll my own solution.

Best Answer

From Dynamic SOSL - SOSL Injection:

SOSL injection is a technique by which a user causes your application to execute database methods you did not intend by passing SOSL statements into your code. This can occur in Apex code whenever your application relies on end user input to construct a dynamic SOSL statement and you do not handle the input properly.

To prevent SOSL injection, use the escapeSingleQuotes method. This method adds the escape character (\) to all single quotation marks in a string that is passed in from a user. The method ensures that all single quotation marks are treated as enclosing strings, instead of database commands.

Based on that is should be sufficient to escape any single quote characters in the user based input before merging it with your dynamic SOSL.

Related Solutions

[SalesForce] New string methods substring Before/After, etc

A newline is most commonly denoted by the escape character \n and not /n However, with CSV's, you may also want to check for \r\n as it will depend on the Operating System that is saving the file. Difference between '\n' and '\r\n'

string testString = 'Hello\nWorld';
system.debug(testString.substringAfter('\n'));

16:43:16:021 USER_DEBUG [2]|DEBUG|World

[SalesForce] How to insert a string into another string

Lets say you have the following strings.

String1 = 'myString/myPattern/someString'
String2 = 'newString'

You can append your new string just before the required pattern like this.

String newString = 
    String1.substring(0, String1.indexOf('/myPattern')) +
    String2 + 
    String1.substring(String1.indexOf('/myPattern'), String1.length());

But make sure your pattern is not repeated in the String1, because you might end up replacing just the first occurrence.

Best Answer

Related Solutions

[SalesForce] New string methods substring Before/After, etc

[SalesForce] How to insert a string into another string

Related Topic