Escape functions

Escape functions make values safe to embed in specific formats, such as queries, URLs, markup documents, and CSV rows.

ESCAPE THE VALUE, NOT THE WHOLE STRING

Escape each value before you insert it. Don't escape the completed string. Escaping the completed string can alter valid syntax, while skipping escaping can allow injection.

text

f"SELECT Id FROM Account WHERE Name = '{escape_for_soql(_.name)}'"

The quotes form part of the query syntax. Escape only the value between them.

FEATURE AVAILABILITY

WEL is currently available to select customers. Contact your Customer Success Representative to confirm whether it is available in your workspace.

Query languages

Inbound data inserted directly into a query can introduce unintended syntax. The following functions escape values so the query engine treats them as data instead of code.

`escape_for_soql`

Escapes a value for a SOQL string literal in Salesforce. Escapes ' and \.

text

escape_for_soql(value)

Parameter	Description
value	The value to escape.

Escape an apostrophe for SOQL

The following example escapes an apostrophe for a SOQL string literal:

Formula

text

escape_for_soql("O'Brien")

Output

text

O\'Brien

`escape_for_odata`

Escapes a value for an OData filter string literal by doubling each single quote. OData expects a doubled quote instead of a backslash escape.

text

escape_for_odata(value)

Parameter	Description
value	The value to escape.

Escape an apostrophe for OData

The following example escapes an apostrophe for an OData filter string literal:

Formula

text

escape_for_odata("O'Brien")

Output

text

O''Brien

`escape_for_regex`

Escapes regular-expression metacharacters so the pattern matches the string literally.

Use it whenever you build a pattern from data. Without escaping, a value containing . or * can change the pattern's behavior.

text

escape_for_regex(value)

Parameter	Description
value	The value to escape.

Escape regex metacharacters

The following example escapes the regex metacharacters in a string:

Formula

text

escape_for_regex('a.b*c')

Output

text

a\.b\*c

Markup

The following functions escape a value for HTML or XML markup:

`escape_for_html`

Escapes a value for HTML text or an attribute. Escapes &, <, >, ", ', and /.

text

escape_for_html(value)

Parameter	Description
value	The value to escape.

Escape HTML markup characters

The following example escapes the markup characters in an HTML string:

Formula

text

escape_for_html('<b>Tom & Jerry</b>')

Output

text

&lt;b&gt;Tom &amp; Jerry&lt;&#x2F;b&gt;

`escape_for_xml`

Escapes a value for XML text or an attribute, and strips code points that are illegal in XML 1.0.

Removing these code points prevents source-system control characters from producing XML that a parser can't process.

text

escape_for_xml(value)

Parameter	Description
value	The value to escape.

Escape XML markup characters

The following example escapes the markup characters in an XML string:

Formula

text

escape_for_xml('<tag> & more')

Output

text

&lt;tag&gt; &amp; more

Data formats

The following functions escape a value for a specific data or code format:

`escape_for_csv`

Escapes a value for a CSV field, following RFC 4180 by quoting the field and doubling internal quotes when needed.

Pass 'safe_formulas' to prevent CSV formula injection. Spreadsheet applications treat a field beginning with =, +, -, or @ as a formula, so a value from an untrusted source can run when someone opens the file. The option prefixes such a field with an apostrophe.

text

escape_for_csv(value, 'safe_formulas')

Parameter	Description
value	The value to escape.
'safe_formulas'	Optional. Pass this parameter to also neutralize leading formula characters.

Quote a field containing a comma

The following example quotes a CSV field containing a comma:

Formula

text

escape_for_csv('Smith, Josh')

Output

text

"Smith, Josh"

Neutralize a leading formula character

The following example neutralizes a leading formula character with 'safe_formulas':

Formula

text

escape_for_csv('=1+1', 'safe_formulas')

Output

text

"'=1+1"

USE SAFE_FORMULAS FOR ANYTHING A PERSON OPENS

Pass 'safe_formulas' when a person opens the CSV in a spreadsheet application. This option isn't necessary for machine-to-machine processing that doesn't evaluate spreadsheet formulas.

`escape_for_json_string`

Escapes a value to embed inside a JSON string, without adding the surrounding quotes.

Use this when assembling JSON text by hand. Use to_json, which handles escaping throughout, to serialize a whole value instead.

text

escape_for_json_string(value)

Parameter	Description
value	The value to escape.

Escape a quote for a JSON string

The following example escapes a double quote for embedding inside a JSON string:

Formula

text

escape_for_json_string('He said "hi"')

Output

text

He said \"hi\"

`escape_for_javascript`

Escapes a value to embed inside a JavaScript string literal, without the surrounding quotes.

text

escape_for_javascript(value)

Parameter	Description
value	The value to escape.

Escape an apostrophe for JavaScript

The following example escapes an apostrophe for a JavaScript string literal:

Formula

text

escape_for_javascript("O'Brien")

Output

text

O\'Brien

URLs and query strings

These three related functions handle spaces differently. Choose the function that matches the required URL format:

Function	Space becomes	Use for
`escape_for_url`	`%20`	A whole string, as defined in RFC 3986
`uri_encode_www_form_component`	`%20`	One component of a URL
`uri_encode_www_form`	`+`	A whole form-encoded query string

`escape_for_url`

Percent-encodes a string as defined in RFC 3986.

text

escape_for_url(value)

Parameter	Description
value	The value to encode.

Percent-encode a whole string

The following example percent-encodes a whole string as defined in RFC 3986:

Formula

text

escape_for_url('name=Kalani Park&x=1')

Output

text

name%3DKalani%20Park%26x%3D1

`uri_encode_www_form_component`

Percent-encodes a single URI component. Unreserved characters pass through unchanged.

text

uri_encode_www_form_component(value)

Parameter	Description
value	The component to encode.

Percent-encode a single component

The following example percent-encodes a single URI component:

Formula

text

uri_encode_www_form_component('Kalani Park')

Output

text

Kalani%20Park

`uri_decode_www_form_component`

Decodes a percent-encoded URI component.

text

uri_decode_www_form_component(value)

Parameter	Description
value	The component to decode.

Decode a percent-encoded component

The following example decodes a percent-encoded URI component:

Formula

text

uri_decode_www_form_component('Kalani%20Park')

Output

text

Kalani Park

`uri_encode_www_form`

Encodes a Map as an application/x-www-form-urlencoded query string. Spaces become +.

text

uri_encode_www_form(map, options)

Parameter	Description
map	The map of parameters.
options	Optional map specifying the `dialect`. `'whatwg'` repeats the key for a list, and `'rack'` writes `key[]`.

Encode a map as a query string

The following example encodes a map as a form-urlencoded query string:

Formula

text

uri_encode_www_form({status: 'open', q: 'blue widget'})

Output

text

status=open&q=blue+widget

`uri_decode_www_form`

Decodes a query string into a Map. A + becomes a space.

text

uri_decode_www_form(text, options)

Parameter	Description
text	The query string to decode.
options	Optional map to control decoding. `collect_duplicates`: When `true`, a repeated key collects into a list. `dialect`: `'rack'` reads `key[]` arrays. `'whatwg'` treats keys as opaque.

Decode a query string into a map

The following example decodes a form-urlencoded query string into a map:

Formula

text

uri_decode_www_form('status=open&q=blue+widget')

Output

text

{status: "open", q: "blue widget"}

Use case: Build a filtered API request

Search terms from inbound data can contain spaces and punctuation. Encode the parameters as a map instead of concatenating strings to escape each value and preserve the separators:

Input

json

{
  "status": "open",
  "search": "blue widget & more"
}

Formula

text

f"/api/v2/orders?{uri_encode_www_form({status: _.status, q: _.search})}"

Output

json

"/api/v2/orders?status=open&q=blue+widget+%26+more"

uri_encode_www_form encodes the & inside the search term as %26 so it isn't mistaken for a parameter separator, and leaves the & that genuinely separates the two parameters untouched.

JSON functions: Use to_json to serialize a whole value.
String functions: Regular-expression matching and replacement.
Encoding functions: Character encodings, not escaping.
Strings and formatting: More information about f-strings.

Last updated:

Escape functions ​

Query languages ​

escape_for_soql ​

escape_for_odata ​

escape_for_regex ​

Markup ​

escape_for_html ​

escape_for_xml ​

Data formats ​

escape_for_csv ​

escape_for_json_string ​

escape_for_javascript ​

URLs and query strings ​

escape_for_url ​

uri_encode_www_form_component ​

uri_decode_www_form_component ​

uri_encode_www_form ​

uri_decode_www_form ​

Use case: Build a filtered API request ​

Related ​

Escape functions

Query languages

`escape_for_soql`

`escape_for_odata`

`escape_for_regex`

Markup

`escape_for_html`

`escape_for_xml`

Data formats

`escape_for_csv`

`escape_for_json_string`

`escape_for_javascript`

URLs and query strings

`escape_for_url`

`uri_encode_www_form_component`

`uri_decode_www_form_component`

`uri_encode_www_form`

`uri_decode_www_form`

Use case: Build a filtered API request

Related