apex – ApexSOQLInjection clarification with respect to binding of variables

I went through the trailhead module on SOQL injection, however I am not clear on below items:

Scenario 1) Is escapeSingleQuotes here needed ?
// Consider that userinput is coming from user 
userinput = String.escapeSingleQuotes(userinput); // Is this needed ? 
String soql="SELECT Id FROM Account WHERE Name =:userinput";
System.debug(Database.query(soql));

In above case, if there was concatenation, then I can see the risk of SOQL injection but when variable binding happens, then I am not very sure if escaping is needed. If escaping is needed, then I would love to see example where if escaping is not done, how soql injection can happen with binding of variables.

Scenario 2) Is escapeSingleQuotes here needed ?
// Consider names is holding list of names and its coming from user
List<String> escapedNames = new List<String>();
for(String name : names){
  escapedNames.add(String.escapeSingleQuotes(name)); // Is this needed ?
}
String soql="SELECT Id FROM Account WHERE Name IN:escapedNames";
System.debug(Database.query(soql));

Note: I have went through many stack exchange questions and I see the suggestion of preferring static query, which I agree. However, I would like to understand what should be done in the cases of dynamic queries in which some form of concatenation is used along with binding of variables. To keep example simple, I did not include example of concatenation + binding.

Read more here: Source link