Question

Typically I use integer ids in my application, but for this one piece of dev I am doing look ups on a text field – a tag name.

I do make use of cfqueryparam but considering that it’s a text field, could it be vulnerable to sql injection attacks, and if so, how do other people get around this other than tediously searching the string for SQL commands.

My query looks something like:

SELECT tagId -- etc etc
FROM tag
WHERE tagName = <cfqueryparam cfsqltype="cf_sql_varchar" maxlength="50" value="#arguments.tagName#" />

Thanks

Answer 1

That’s safe by virtue of the fact that you’re using <cfqueryparam>. That’s what the tag does. It sends the value as text (or whatever the cfsqltype happens to be), not a command to be executed.