---
title: "Comment by Joe Kerr on \"Writing Fast Queries in APEX\" | Hashnode"
description: "Very helpful both for the code, and the perspective. Are there security concerns here from having a function that creates a query from inputs vs. a \"hard coded\""
url: "https://hashnode.com/posts/writing-fast-queries-in-apex/67dd8f8b5b905023af864ac2/comment/67e7db0fd046255723a17507"
---

[Discussion](https://hashnode.com/posts/writing-fast-queries-in-apex/67dd8f8b5b905023af864ac2)

Comment [Writing Fast Queries in APEX](https://hashnode.com/posts/writing-fast-queries-in-apex/67dd8f8b5b905023af864ac2)

[Joe Kerr](https://hashnode.com/@jkerr)

[Mar 29, 2025](https://hashnode.com/posts/writing-fast-queries-in-apex/67dd8f8b5b905023af864ac2/comment/67e7db0fd046255723a17507)

Very helpful both for the code, and the perspective. Are there security concerns here from having a function that creates a query from inputs vs. a "hard coded" query?

[Anton Nielsen](https://hashnode.com/@ainielsen)

[Apr 3, 2025](https://hashnode.com/posts/writing-fast-queries-in-apex/67dd8f8b5b905023af864ac2/comment/67e7db0fd046255723a17507#reply-67eed3cdb5891a5450e1c872)

No extra security concerns at all. In fact, that's one reason I decided to write the function. This function uses bind variable and, although it does concatenate on unescaped column names, those columns names are defined by the developer at design time, not run time, and they can't be changed at run time. The only security concern is with the developer, which is the same as it is for a hard coded query.