What is Apex Secure Coding?<\/h2>\n\n\n\n
Apex Secure Coding is a set of habits that treat every outside value as untrusted until you check it. Outside values include URL parameters, form inputs, JSON from a component and data from other systems. Safe code keeps that input as data, never as code, query text or HTML.<\/p>\n\n\n\n
Think of a bank teller. When a customer hands over a note saying “Give me 500 rupees”, a careful teller checks the account and the amount. However, a careless teller follows any note, even one saying “Also open the vault”. Secure code is the careful teller.<\/p>\n\n\n\n
Why Apex Secure Coding Matters<\/h2>\n\n\n\n
Salesforce protects the platform, but your custom code is your responsibility. Here is why Apex Secure Coding matters at Bright Path Tutors.<\/p>\n\n\n\n
- \n
- First, a search box on a public course page passes text straight into a query.<\/li>\n\n
- Also, a Visualforce page shows a student’s comment, which might contain script.<\/li>\n\n
- Next, a link that cancels an enrolment could be clicked from a phishing email.<\/li>\n\n
- A login page redirect could send students to a fake site.<\/li>\n\n
- Finally, an API key in Apex code is visible to anyone who can read the class.<\/li>\n<\/ul>\n\n\n\n
So without Apex Secure Coding, one weak line can undo every sharing rule you set.<\/p>\n\n\n\n
How Apex Secure Coding Works<\/h2>\n\n\n\n
Apex Secure Coding follows the same steps for any input. First, find every place where outside data enters your code. Next, decide what that data should look like, such as an Id, a number or plain text. Then validate it, for example with an allow list or Id.valueOf. After that, use it safely: bind variables in queries, encoding in HTML, and POST requests for changes. Finally, test the code with hostile input and run Code Analyzer.<\/p>\n\n\n\n
![\"Apex](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/apex-secure-coding-xss-csrf-injection-diagram-1-1024x640.png\")
The steps for handling any outside input safely.<\/figcaption><\/figure>\n\n\n\n SOQL Injection<\/h3>\n\n\n\n
SOQL injection happens when user text is joined into a dynamic query, so the user can change its logic. Bind variables or String.escapeSingleQuotes stop it.<\/p>\n\n\n\n
Cross-Site Scripting (XSS)<\/h3>\n\n\n\n
XSS happens when user input is shown as HTML, so a script runs in another user’s browser. Visualforce and LWC escape output by default. The risk appears when you turn escaping off, such as escape=”false” or setting innerHTML.<\/p>\n\n\n\n
Cross-Site Request Forgery (CSRF)<\/h3>\n\n\n\n
CSRF tricks a logged-in user into sending a request they did not intend. In Visualforce, the risk appears when code changes data on page load, in a constructor or an action attribute. Salesforce protects normal form posts with a token.<\/p>\n\n\n\n
Open Redirects<\/h3>\n\n\n\n
An open redirect sends users to any URL passed in a parameter, such as retURL. Attackers use it to make phishing links look trusted. So allow only relative URLs or known domains.<\/p>\n\n\n\n
Hard-Coded Secrets<\/h3>\n\n\n\n
Passwords, tokens and API keys in Apex are readable by anyone with code access. Store them in named credentials, external credentials or protected custom metadata instead.<\/p>\n\n\n\n
Common Attacks and Fixes<\/h2>\n\n\n\n
The table below sums up each attack and its fix.<\/p>\n\n\n\n
Attack<\/th> Unsafe pattern<\/th> Safe fix<\/th><\/tr><\/thead> SOQL injection<\/td> Joining user text into a query<\/td> Bind variables<\/td><\/tr> XSS<\/td> escape=”false” or innerHTML<\/td> Default escaping, HTMLENCODE<\/td><\/tr> CSRF<\/td> DML in constructor or page action<\/td> Change data only on user POST<\/td><\/tr> Open redirect<\/td> Redirect to any retURL<\/td> Allow relative URLs only<\/td><\/tr> Hard-coded secret<\/td> Key in an Apex string<\/td> Named or external credential<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n XSS vs CSRF<\/h2>\n\n\n\n
The table below compares the two web attacks people mix up most.<\/p>\n\n\n\n
Feature<\/th> XSS<\/th> CSRF<\/th><\/tr><\/thead> What runs<\/td> Attacker’s script in the page<\/td> A real request from the user<\/td><\/tr> Main cause<\/td> Unescaped output<\/td> Data changes without user intent<\/td><\/tr> Victim sees<\/td> A page that behaves oddly<\/td> Often nothing at all<\/td><\/tr> Salesforce default protection<\/td> Output escaping<\/td> Tokens on form posts<\/td><\/tr> Your fix<\/td> Keep escaping on<\/td> No DML on page load<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n When to use which fix depends on the attack. For XSS, protect output. For CSRF, protect actions that change data.<\/p>\n\n\n\n
![\"Apex](\"https:\/\/swapnilzambare.com\/blog\/wp-content\/uploads\/2026\/11\/apex-secure-coding-xss-csrf-injection-diagram-2-1024x640.png\")
XSS vs CSRF.<\/figcaption><\/figure>\n\n\n\n A Real Apex Secure Coding Example<\/h2>\n\n\n\n
Let’s apply Apex Secure Coding to three pieces of code at Bright Path Tutors.<\/p>\n\n\n\n
Step 1: Fix SOQL Injection<\/h3>\n\n\n\n
\/\/ UNSAFE: user text becomes part of the query\nString q = 'SELECT Id, Name FROM Course__c WHERE Name LIKE \\'%' + searchText + '%\\'';\nList<Course__c> bad = Database.query(q);\n\n\/\/ SAFE: user text stays a bind value\nString pattern = '%' + searchText + '%';\nList<Course__c> good = [SELECT Id, Name FROM Course__c\n WHERE Name LIKE :pattern\n WITH USER_MODE];<\/code><\/pre>\n\n\n\nIn the unsafe version, a search such as
x' OR Name != '<\/code> changes the filter and returns every course. In the safe version, the text is only a value, so the query logic cannot change.<\/p>\n\n\n\nStep 2: Fix XSS in Visualforce<\/h3>\n\n\n\n
<!-- UNSAFE: student comment rendered as HTML -->\n<apex:outputText value=\"{!enrolment.Comment__c}\" escape=\"false\"\/>\n\n<!-- SAFE: default escaping, and encoding inside JavaScript -->\n<apex:outputText value=\"{!enrolment.Comment__c}\"\/>\n<script>\n var comment = '{!JSENCODE(enrolment.Comment__c)}';\n<\/script><\/code><\/pre>\n\n\n\nWith escape=”false”, a comment containing a script tag runs in the tutor’s browser. The safe version keeps escaping on. Inside JavaScript, JSENCODE stops the text from breaking out of the string. In LWC, the same rule means binding text with {comment} instead of setting innerHTML.<\/p>\n\n\n\n
Step 3: Fix CSRF in a Visualforce Controller<\/h3>\n\n\n\n
public with sharing class CancelEnrolmentController {\n\n public Id enrolmentId { get; set; }\n\n \/\/ UNSAFE: cancelling inside the constructor runs on a simple GET link\n \/\/ public CancelEnrolmentController() { cancel(); }\n\n public CancelEnrolmentController() {\n enrolmentId = ApexPages.currentPage().getParameters().get('id');\n }\n\n \/\/ SAFE: runs only when the user clicks the Cancel button (a POST)\n public PageReference cancel() {\n update as user new Enrolment__c(Id = enrolmentId, Status__c = 'Cancelled');\n return null;\n }\n}<\/code><\/pre>\n\n\n\nThe constructor only reads the Id. The update happens in an action method bound to a command button, which Salesforce protects with a CSRF token. So a link in an email cannot cancel enrolments on its own.<\/p>\n\n\n\n
Step 4: Check with a Test<\/h3>\n\n\n\n
Here is what a quick security test of the search method shows.<\/p>\n\n\n\n
search('x\\' OR Name != \\'') -> 0 courses (safe)\nsearch('Apex') -> 3 courses<\/code><\/pre>\n\n\n\nAs a result, the hostile input finds nothing, while normal searches still work.<\/p>\n\n\n\n
Apex Secure Coding for Secrets and Redirects<\/h2>\n\n\n\n
Never write an API key in Apex. Instead, store it in a named credential, which Level 9 covers. For redirects, accept only values that start with a single slash, or compare the domain against an allow list, before calling new PageReference(url).<\/p>\n\n\n\n
Common Mistakes with Apex Secure Coding<\/h2>\n\n\n\n
- \n
- Joining user input into dynamic SOQL.<\/li>\n\n
- Turning off escaping to show formatted text.<\/li>\n\n
- Running DML in constructors or page action attributes.<\/li>\n\n
- Redirecting to any URL from a parameter.<\/li>\n\n
- Storing passwords and tokens in Apex or plain custom settings.<\/li>\n<\/ul>\n\n\n\n
Best Practices for Apex Secure Coding<\/h2>\n\n\n\n
- \n
- Treat every outside value as untrusted.<\/li>\n\n
- Use bind variables and allow lists for dynamic queries.<\/li>\n\n
- Keep default escaping on, and encode for the context.<\/li>\n\n
- Change data only on explicit user actions, never on page load.<\/li>\n\n
- Run Salesforce Code Analyzer on every change.<\/li>\n<\/ul>\n\n\n\n
Practice Task<\/h2>\n\n\n\n
Write a method that sorts courses by a field name passed from a component. Allow only Name, Fee__c and Start_Date__c, and reject anything else. Hint: check the value against a Set<String> before building the ORDER BY clause.<\/p>\n\n\n\n
Most Asked Interview Questions on Apex Secure Coding<\/h2>\n\n\n\n
Security review questions appear in many senior interviews. Here are the 21 questions asked most about Apex Secure Coding.<\/p>\n\n\n\n
Basic Questions on Apex Secure Coding<\/h3>\n\n\n\n
Q1: What is SOQL injection?<\/strong><\/p>\n\n\n\n
An attack where user input changes the logic of a dynamic SOQL query.<\/p>\n\n\n\n
Q2: How do you prevent SOQL injection?<\/strong><\/p>\n\n\n\n
Use bind variables, allow lists, and String.escapeSingleQuotes when binding is impossible.<\/p>\n\n\n\n
Q3: What is XSS?<\/strong><\/p>\n\n\n\n
Cross-site scripting, where attacker input runs as script in another user’s browser.<\/p>\n\n\n\n
Q4: Does Visualforce escape output by default?<\/strong><\/p>\n\n\n\n
Yes, unless you set escape=”false”.<\/p>\n\n\n\n
Q5: What is CSRF?<\/strong><\/p>\n\n\n\n
Cross-site request forgery, where a user is tricked into sending a request that changes data.<\/p>\n\n\n\n
Q6: Where should you store API keys?<\/strong><\/p>\n\n\n\n
In named credentials or external credentials, not in Apex code.<\/p>\n\n\n\n
Q7: What is an open redirect?<\/strong><\/p>\n\n\n\n
A redirect to any URL taken from user input, often used in phishing.<\/p>\n\n\n\n
Code and Scenario Questions on Apex Secure Coding<\/h3>\n\n\n\n
Q8: Why is DML in a Visualforce constructor risky?<\/strong><\/p>\n\n\n\n
It runs on a simple GET request, so a link can change data without a CSRF token.<\/p>\n\n\n\n
Q9: What does JSENCODE do?<\/strong><\/p>\n\n\n\n
It encodes text so it is safe inside a JavaScript string.<\/p>\n\n\n\n
Q10: When would you use HTMLENCODE?<\/strong><\/p>\n\n\n\n
When you output user data inside HTML that is not escaped automatically.<\/p>\n\n\n\n
Q11: How does LWC protect against XSS?<\/strong><\/p>\n\n\n\n
Template bindings escape values. Risk appears when you set innerHTML or use lwc:dom=”manual” with user data.<\/p>\n\n\n\n
Q12: How do you safely allow a dynamic sort field?<\/strong><\/p>\n\n\n\n
Check it against an allow list of field names before adding it to the query.<\/p>\n\n\n\n
Q13: Is String.escapeSingleQuotes enough on its own?<\/strong><\/p>\n\n\n\n
It helps for string values, but binds and allow lists are safer and cover more cases.<\/p>\n\n\n\n
Q14: How do you validate an Id parameter?<\/strong><\/p>\n\n\n\n
Convert it with Id.valueOf inside try and catch, and check its object type.<\/p>\n\n\n\n
Advanced Questions on Apex Secure Coding<\/h3>\n\n\n\n
Q15: Why do sharing and CRUD checks not stop XSS?<\/strong><\/p>\n\n\n\n
They control data access, while XSS abuses how allowed data is displayed.<\/p>\n\n\n\n
Q16: How do you protect redirects such as retURL?<\/strong><\/p>\n\n\n\n
Allow only relative paths or known domains.<\/p>\n\n\n\n
Q17: Should error pages show stack traces?<\/strong><\/p>\n\n\n\n
No. Show a friendly message and log the details, because traces reveal code structure.<\/p>\n\n\n\n
Q18: What does the AppExchange security review check?<\/strong><\/p>\n\n\n\n
Injection, XSS, CSRF, CRUD and FLS, sharing, secrets and insecure endpoints, among others.<\/p>\n\n\n\n
Q19: How do you protect JSON input from a component?<\/strong><\/p>\n\n\n\n
Deserialize into typed classes, validate values, and run user mode or stripInaccessible before DML.<\/p>\n\n\n\n
Q20: Is data from an integration trusted?<\/strong><\/p>\n\n\n\n
No. Validate it like user input, because the other system may be compromised.<\/p>\n\n\n\n
Q21: Which tool finds many of these issues automatically?<\/strong><\/p>\n\n\n\n
Salesforce Code Analyzer, with PMD and other engines.<\/p>\n\n\n\n
Official Resources<\/h2>\n\n\n\n