Question

I’m trying to feed a variables into an MySQL query from Coldfusion. My query currently includes:

<cfif Session.app_assign EQ "0">
    AND art.iln IN ( #Session.app_ilns# )
<cfelseif Session.app_assign EQ "1">
    AND art.marke IN ( "#Session.app_keys#" )
</cfif>

Session.app_ilns will be a list of numbers like so: 1111111111111,2222222222222…. which works fine. Howerver, Session.app_keys will be list of strings, like:

sample_1, sample_2, sample_3

which will produce an error in my script, because of

unknown column "sample_1, sample_2, sample_3" in where clause.

Question:
Is there a way to use MySQL IN with a list of string values or do I need to pre-loop over the variables to add quotation marks. Are there any other ways to get this done?

Thanks!

Answer 1

Try using a cfqueryparam (good practice anyhow) with list="yes"

See this Ben Nadel blog post

Code would look like:

AND art.marke IN ( <cfqueryparam value="#Session.app_keys#" cfsqltype="cf_sql_varchar" list="yes" />)