api - SOQL Injection in SFDC -

what best way avoid soql injection when querying salesforce through apis? 2 main apis interested in soap , rest apis. current methods never use input user (which impractical if searching company name) or encoding characters within string.

however saw there parameterisation within apex, wondering if there similar way of doing through apis.

philosophical rant

what after :)

if application should work same way accessed different sources (salesforce ui, php connector, mobile applications) makes sense think apex stored procedures reused. means you'd passing safe parameters them.

if plan hand-craft queries & not rely on apex hard - maybe need database.com or other cloud-based db solutions?

actual answer

i'm not aware of out of box way pass separately query command , separately params (like bind variables/prepared statements) through apis. both rest , soap api give what's database.query() within apex. sure, there differences retrieve() command or querymore() that's baseline.

what either expose commonly used searches methods similar john proposed (bonus points performance - they're precompiled) or build generic?

list<sobject> runquery(string query, list<list<string>> params){...} 

if runquery contain bind variables params[0] should work. looks crazy , didn't test though ;) i'd bind variables best method. alternative escape user's input sql , xss injections can become amazingly creative. check examples of xss can use test page input? start (yes, i'm aware asked soql only).

as actual soql injection: http://wiki.developerforce.com/page/secure_coding_sql_injection. since "worst can happen" users search more supposed (no way convert select insert) escaping should safe-ish...