# Preventing UI and data access vulnerabilities

*Platform Developer Study Guide · User Interface · Last updated October 15, 2026 · https://www.certifyforce.com/study-guide/platform-developer/user-interface/preventing-ui-and-data-access-vulnerabilities*

How to make Apex behind Lightning components and Visualforce respect object, field and record access (user mode, stripInaccessible, sharing keywords), and how to stop SOQL injection, cross-site scripting and CSRF in the UI.

- Certification: Salesforce Platform Developer
- Exam section: User Interface
- Study guide: https://www.certifyforce.com/study-guide/platform-developer

**Official exam objective:**

> Given a scenario, prevent user interface and data access security vulnerabilities.

## What the exam expects

- For Apex behind a Lightning component, flow or Visualforce page, pick what enforces record access (sharing keywords), object and field access (user mode, `WITH SECURITY_ENFORCED`, `stripInaccessible`, describe checks), or both, and whether it throws or silently drops fields.
- Predict an entry-point class's sharing mode with an explicit, inherited or omitted declaration.
- Fix SOQL injection with bind variables or `String.escapeSingleQuotes()`, and cross-site scripting with default escaping, `JSENCODE`/`HTMLENCODE` or sanitizing base components.
- Recognize built-in protection: standard controllers, Lightning Data Service, anti-CSRF tokens, Lightning Web Security.

**Key terms.** *System mode*: Apex's default, ignoring the running user's object and field permissions. *User mode*: a database operation that applies the running user's object permissions, field-level security (FLS) and sharing. *CRUD/FLS*: object and field permissions. *SOQL injection*: user input that changes a dynamic query's logic. *XSS*: attacker-supplied script executed in another user's browser.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Apex default | System mode: object permissions and FLS of the running user are ignored | [Enforce Object and Field Permissions](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm) |
| Sharing keywords scope | Record access only; object access and FLS are never enforced by the sharing mode | [Sharing Keywords](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm) |
| Omitted declaration, LWC `@AuraEnabled` entry | Defaults to with sharing; Visualforce controller, REST and async default to without sharing | [Sharing Keywords](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm) |
| `WITH USER_MODE` | Enforces object permissions, FLS and sharing; finds all FLS errors, not just the first | [Enforce User Mode](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_enforce_usermode.htm) |
| `WITH SECURITY_ENFORCED` | Checks SELECT and FROM fields only, throws `System.QueryException`, Apex only | [WITH SECURITY_ENFORCED](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_enforced.htm) |
| `stripInaccessible` | Removes inaccessible fields without an exception; never strips Id; no AggregateResult | [stripInaccessible](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_stripInaccessible.htm) |
| User-mode DML | `insert as user` or `Database.insert(recs, AccessLevel.USER_MODE)` throws on missing FLS | [Enforce User Mode](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_enforce_usermode.htm) |
| Custom Visualforce controller | Runs entirely in system mode; standard controller logic runs in user mode | [Custom Controllers and Extensions](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_controller_def.htm) |
| LDS base components and `lightning/ui*Api` | UI API responses respect CRUD, FLS and sharing | [Lightning Data Service](https://developer.salesforce.com/docs/platform/lwc/guide/data-ui-api.html) |
| Dynamic SOQL that can't use binds | `String.escapeSingleQuotes()` on the user input | [SOQL Injection](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_soql_injection.htm) |

## Check yourself

- Why doesn't `with sharing` stop a component from showing a field hidden by FLS?
- When should you choose `Security.stripInaccessible` over `WITH USER_MODE`?
- When is the Visualforce anti-CSRF token bypassed?
- Which encoding function protects a merge field written into a Visualforce JavaScript string?

## Sources

- [Enforce User Mode for Database Operations](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_enforce_usermode.htm)
- [Use the with sharing, without sharing, and inherited sharing Keywords](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm)
- [Enforce Object and Field Permissions](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_perms_enforcing.htm)
- [Enforce Security with the stripInaccessible Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_stripInaccessible.htm)
- [Filter SOQL Queries Using WITH SECURITY_ENFORCED](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_with_security_enforced.htm)
- [SOQL Injection](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_soql_injection.htm)
- [Cross Site Scripting (XSS)](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_xss.htm)
- [Unescaped Output and Formulas in Visualforce Pages](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_scontrols.htm)
- [Cross-Site Request Forgery (CSRF)](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_csrf.htm)
- [What are Custom Controllers and Controller Extensions?](https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_controller_def.htm)
- [Lightning Data Service](https://developer.salesforce.com/docs/platform/lwc/guide/data-ui-api.html)
- [lightning-formatted-rich-text](https://developer.salesforce.com/docs/component-library/bundle/lightning-formatted-rich-text/documentation)
- [Lightning Web Security](https://developer.salesforce.com/docs/platform/lwc/guide/security-lwsec-intro.html)
- [Using the runAs Method](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_testing_tools_runas.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 19 linked practice questions, and unlimited timed mock exams are included with the Platform Developer pack (USD $19): https://www.certifyforce.com/practice-exams