What is SOQL Injection, and how do you prevent it using bind variables or String.escapeSingleQuotes()?

SOQL injection happens when user input is concatenated into a dynamic query, letting an attacker change its logic (e.g. input ' OR Name != ').

Prevention:

• Use static SOQL with bind variables (:name)
• With dynamic SOQL, use Database.queryWithBinds or bind variables inside the string
• Sanitize with String.escapeSingleQuotes() when you must concatenate
• Validate input against allowed values (whitelist) for field/object names

String name = String.escapeSingleQuotes(userInput);
String q = 'SELECT Id FROM Account WHERE Name = \'' + name + '\'';