Question

I have a in house cold fusion script. i want to put the url.variable into the sql select statement as follows:

SELECT * 
FROM table1 a JOIN table2 b ON a.id=b.id
WHERE #a.url.variable# LIKE'%test%'

I cant seem to get it to display any data when I put the variable right after the word ‘WHERE’

Answer 1

You need to put hashes around it as follows:

SELECT * 
FROM table1 a 
JOIN table2 b ON a.id=b.id 
WHERE a.#url.variable# LIKE '%test%'

You can’t use a cfqueryparam in this case so I’d also ensure that URL.variable has been escaped of any SQL injection characters before using it in your query.