Salesforce is a leading cloud-based customer relationship management (CRM) platform and Salesforce is secure by default. However, with great power comes great responsibility. As a developer, it’s very important that your code is Secure and doesn’t compromise the data of your organization or its customers. In this blog, we’ll explore some of the secure code options in Salesforce for SOQL queries.

Salesforce Object Query Language (SOQL) is a very powerful tool that allows developers to retrieve and manipulate data from the Salesforce database in a flexible and efficient manner. However, if not used correctly, SOQL can expose sensitive data to unauthorized users or compromise the quality of your organization’s data. Here are some of the secure code options in Salesforce for SOQL queries.

Use field-level security

Salesforce allows administrators to restrict access to certain fields of a record based on the user’s profile or role. By using field-level security we can ensure which users can access specific fields and who are not. To use the field-level security, we can add “WITH SECURITY_ENFORCED” clauses to the SOQL which will ensure all field-level security for fields that are queried.

for example

List<Contact> accts = [SELECT Id, Name, Email FROM Contact WHERE Name LIKE ‘Anna’ WITH SECURITY_ENFORCED];

Avoid storing sensitive data:

Keeping confidential data in source code is not considered as a best practice. Because Anyone who has access to the source code can clearly view the data. So, Do not write any Sensitive content in debug logs such as passwords, API tokens, and Secret keys.

It is not recommended for external applications to store salesforce user credentials (such as usernames, passwords, session IDs, etc) in an external database. Instead, the OAuth flow should be utilized to integrate an external application with Salesforce user accounts.

Use parameterised queries:

Parameterized queries are a way to securely query a database by passing input values as parameters. Parameterized queries that allow you to write dynamic SOQL queries that are protected against SQL injection attacks. SQL injection attacks occur when an attacker uses malicious input to change the behavior of a query. To prevent this it’s best practice to use Parameterised queries. Here is an example of parameterized SOQL query in Salesforce.

String searchStr = ‘Acme’;
List<Account> accts = [SELECT Id, Name, Industry FROM Account WHERE Name LIKE:searchStr LIMIT 10];

In the above example, the searchStr input value is passed as a parameter to the LIKE” operator in the SOQL query. Salesforce automatically validates and formats the input to prevent any SQL injection attacks.

Overall, it’s important to keep security in mind when writing SOQL queries in Salesforce. By using the above options, you can ensure that your queries are safe from unauthorized access and protect your organization’s data. Remember to always stay up to date with the latest security features, and patches. Follow secure guidelines provided by Salesforce.

Using CRUD operations

CRUD operations in Salesforce refer to Create, Read, Update, and Delete operations that can be performed on Salesforce records. These operations are fundamental to Salesforce data management and play a critical role in ensuring secure coding practices.

Here’s an example of how CRUD operations can be used in secure coding in Salesforce:

Let’s say we have a custom object called “Customer_Orders__c” which stores customer order data. We want to create a new record for a new customer order, but we also want to ensure that only authorized users can perform this action. To achieve this, we can use CRUD operations to limit the access of users to specific records.

In our example, we can set up the following CRUD access for the “Customer_Orders__c” object:

• Create access: limited to specific profiles/roles that are authorized to create new records
• Read access: available to all users who need to view existing records
• Update access: limited to specific profiles/roles that are authorized to modify existing records
• Delete access: limited to specific profiles/roles that are authorized to delete existing records

Here’s an example code snippet that demonstrates how CRUD operations can be used to create a new customer order record in a secure manner:

//Check if the current user has create access for the Customer_Orders__c object
if (Schema.sObjectType.Customer_Orders__c.isCreateable()){
//Create a new customer order record
Customer_Orders__c newOrder = new Customer_Orders__c();
newOrder.Order_Date__c = Date.today();
newOrder.Order_Amount__c = 100.00;
insert newOrder;
}
else {
//Display an error message if the user does not have create access
ApexPages.addMessage(new ApexPages.Message(ApexPages.Severity.ERROR, ‘You do not have permission to create new customer orders.’));
}

In this example, we are checking whether the user has create access for the “Customer_Orders__c” object. If the user has the required access, we create a new customer order record and insert it into the database. If the user does not have the required access, we display an error message indicating that the user does not have permission to create new customer orders.

By using CRUD operations in this manner, we can ensure that only authorized users can create new records and maintain the security of our Salesforce data.

Use Salesforce Shield

Salesforce Shield is a suite of security tools that provide an extra layer of protection for your Salesforce data. It includes several features including event monitoring, field audit trails, platform encryption, and Einstein data detect.

Event monitoring: Salesforce Event Monitoring is a feature that allows organizations to monitor and analyze users’ activity within the Salesforce platform. It provides detailed information about users like who is accessing the system, what are they doing, and when they are doing it. This information helps organizations to identify security threats, ensure compliance with regulations and improve overall System performance.

Shield platform encryption: By using platform encryption, we can encrypt the data at rest in the salesforce platform which means that the data is encrypted when the data is presented in the database. And it can only be decrypted by authorized users. It is very helpful in healthcare organizations and financial Industries by using Shield platform encryption we can protect sensitive patient data and Sensitive customer information such as bank account numbers, security numbers, and credit card information.

Einstein data detect: Einstein Data Detect is an artificial intelligence tool. It is used to detect sensitive data within their salesforce environment. It uses machine-learning algorithms to automatically scan data fields and identify sensitive information such as credit card numbers, social security numbers, and other personally identifiable information.
Here’s an example of how Salesforce Einstein Data Detect can be used:
Let’s say you work for a financial company that uses Salesforce to manage customer information. You have a large database of customer records, and you need to ensure that sensitive data such as credit card numbers and security numbers are protected.

Salesforce field audit trail:

Salesforce Field Audit Trails is a feature that allows organizations to track changes to fields in salesforce objects over time. It provides an audit trail of all changes made to specific fields, including the old and new values, the user who made the change, and the date and time of the change.

Below is the sample scenario showcasing the practical application of Salesforce Field Audit Trails:

Suppose you work for an ABC company that uses Salesforce to manage customer information. You have a field in your account object called “Preferred Contact Method” , which allows your sales team to record the Customers preferred method of Contact(phone, email or mail)

By using Salesforce Shield we can protect the data from unauthorized access, and monitor any suspicious activity on Salesforce org.