Home/ Questions/Q 7633067
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T06:46:53+00:00

I developed a web site for a client where they will post images of

  • 0

I developed a web site for a client where they will post images of their merchandise online. The url is www.domiainname.com/item-details.cfm?sku=125. Someone tried browsing to www.domiainname.com/item-details.cfm?sku=125%20and%203=3 which produced and error in which I’m notified.

I’ve also received error reports of:

item-details.cfm?sku=1291+or+1=@@version-- 
item-details.cfm?sku=1291'+or+1=@@version 
item-details.cfm?sku=1291+or+1=@@version

The last three examples are definitely of someone trying to get into the system, right?

If we converted this to be stored procedures, would that reduce or eliminate the risk of insertion attacks?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Yes, it appears that someone is being malicious.

    Using cfqueryparam will prevent SQL-injection attacks. When in doubt (and it’s CF), ask Ben:

    SQL Injection Attacks, Easy To Prevent, But Apparently Still Ignored

    Example:

    <cfquery ...>
    SELECT    *
    FROM      Products
    WHERE     SKU=<cfqueryparam value="#URL.SKU#" cfsqltype="CF_SQL_INTEGER">
</cfquery>
    • 0