Something else to keep in mind ... in the end, "the exam" is not the point. "Passing the exam and getting the piece of paper" is not a Golden Ticket." Exam-cram books are sometimes a very good, very concentrated source of practical information.  (I cannot speak personally for the ColdFusion materials since I have never examined them, although I have contributed to exams in other disciplines.)  But it is the process of studying for an exam that makes the difference ... whether or not you subsequently take and/or pass the exam itself. Therefore, you should get the exam materials, download a copy of ColdFusion (and maybe MS SQL Server Express and/or MySQL, all of which are free and entirely legal for this purpose), and take as much time as you need to ... working through the exercises again and again until you really understand them.  You need to know the material thoroughly enough that "passing the exam" would be such a foregone conclusion that you might not even bother actually doing it. A great many of the successful practitioners in this business are self-taught, and what I have just described is a form of self-teaching.  The designers of these exams are generally sought-after because they are considered to be the best in their fields.  They know that one purpose of the materials is "to sell examinations," and if that is all you're looking for that's all you'll receive.  But if you look deeper, and work harder, it's there to be had. Good luck. ... View more

The "gotcha" here is that you're trying to work within the ColdFusion framework's way of doing things, without "stepping out of it" to do straight JavaScript coding.  (And I frankly recommend that you probably shouldn't "step out of it."  That's what CF is for.) Be careful that you do not wind up spending an unjustifiable amount of time trying to "make it work." ... View more

If it is a Linux server, try running the command /sbin/ldconfig ... as "root," of course. The Linux loader uses a "cache file" to locate libraries quickly.  If libraries are removed or restructured, and this command is not re-run, the cache will be out-of-date and the loader may crash-and-burn as it looks for things that the cache says are supposed to be there. ... View more

Your comment about "dirt-cheap labor" is prescient.  And, "you get what you pay for." There are lies, damned lies, and ... statistics like these.  Perfect for selling your educational materials or your $50 book or your trade school, to folks who fondly imagine that if they can make a credible use for this-or-that buzzword (which you, of course, are very happy to sell them...), the world will beat a path to their door.  There are lots of people out there who think that way. "Your job" is to be a hospital sysadmin ... not to be "a ColdFusion programmer."  So, you're not going to be on the radar of that statistic anyhow.  Since you, and thousands of folks just like you, don't even appear as a blip on their scope, the picture that it paints is meaningless. ... View more

Thank you for the clarification (regarding XML). There are several aspects which these graphs do not consider: Where, and how, are the applications being deployed.  ColdFusion makes certain tasks considerably easier, which therefore drives its adoption more strongly in some areas vs. others.  The Wild and Wooly Web (WWW) is chock-full of "I wanna have a great big blog for my iddy-biddy business oops I'm broke! buh-bye!!" sites, and "let's do e-commerce to sell the bars of soap that I make as a hobby" sites.  Anything can be used to do that. The entire concept of "legacy code."  An application might be in-service for a very long time:  originally built long ago, and evolving ever since. If you are measuring job offers, you are not considering how many people are "happily employed and have been so for many years."  (Yes, it really does happen that way sometimes. )  In a corporate environment, a ColdFusion app might be in service, that has been in service for a long time and supported all that time by the same group of well-paid developers. How much do the jobs pay!   Let's face it...  competition does drive price, making a lot of "wild and wooly web" development a race to the bottom.  But to be really good at writing CF-based internal applications, you've got to be really good at a lot of other things too.  And, very likely, you will find yourself being well compensated for those skills. That (especially in ColdFusion shops...) there are many technologies in use at the same time by the same people.  A CF programmer might have other responsibilities and therefore have a job-title that does not say, "CF Developer."  (One of the best developers around here has the title, "CIO."  Seriously.)  When you get ten or fifteen years (or more) "in," you're swapping between technologies like you're swapping hats, and you're doing that every day.  A CF site might be presentng data from a COBOL program that you are also responsible to maintain.  A dot-Net tool might be facing one way while a CF-based tool is facing another way, and you're tasked with both.  Nothing to it.  Par for the course. I don't mean to be entirely crass when I observe that there are a great many junior-programmers out there who basically know "how to write the language" but do not know what to do with it.  The job-pages are stuffed with those people, and with requisitions for them (because they're so darned numerous, they're both cheap and disposable).  ColdFusion is not nearly so likely to be attracting and retaining that demographic. ... View more

Strictly speaking, the pattern might also include the "$" and "^" characters, to "anchor" the pattern to the beginning and to the end of the input string. Otherwise, the pattern would match if a sequence of 6 digits occurred anywhere within the input. Obviously, a length-check (and so on) is enough to preclude this case, in this particular example, but I am speaking to the general case.  There are plenty of "regular-expression tester" web-sites available, and regular-expression implementations are generally comparable the world over. Regular expressions are probably the most important and fundamental validation tool that you have, precisely because they are "generally applicable."  You can use them not only to validate strings, but to extract substrings from them and to perform substring replacements.  Almost every programming language now supports RE's, and you need to learn and know them well. ... View more

Like I said ... ColdFusion works.  In fact, the CFML approach is an extremely clever one ... and its implementation (here/s to you, Adobe, and/or to whomever you bought it from ...) is downright "shrewd."  If you want to quickly implement a web-site or an application server that will handle a lot of users and that will "scale-up" without having to be reimplemented, you'd be hard pressed to find a better solution. It isn't immediately obvious at first glance why this should be so.  A ColdFusion page, after all, looks a whole lot like PHP or something similar.  But here comes the great-big difference:  how the CFML page is used by the ColdFusion engine.  Also:  ColdFusion is fundamentally designed to be an application server, not a web-page server. A CFML page is, effectively, "an XML document."  It does not use XML namespaces in the now-accepted way because (uhh...) it was invented and on-the-scene before that idea came about.  But that's what it is, and it's used as an input to a just-in-time (JIT) compiler.  The CFML code is an XML tree-structure which is (very quickly!) parsed and understood so that the JIT compiler can on-the-fly generate the appropriate code for fast execution. The ColdFusion application server(s), far from being "a general provider of any ol' web-page," (is|are) keenly aware of what each page is doing.  ColdFusion provide a wide variety of features ... threads, shared storage, load balancing, fulltext indexing, links to surrounding programming environments ... some of which are made available implicitly.  That is to say, without demanding a substantial change to the application code. The CFML text is, to some degree, declarative.  It has a certain over-arching sense of "timing" which flows generally from the top of the source-file to the bottom, but a <cfinput> tag (for example) declares what behavior is desired at that point.  The <cftransaction> tag stipulates that all of the code that it encloses should abide by certain characteristics at execution-time.  There are many other examples.  And what the ColdFusion system does with that information, at execution time, in order to accomplish the specified result, is not entirely spelled-out step-by-step in the CFML.  It's determined on-the-fly, based not only on the source-code but also on the context. That is "what all the fuss is about."  You can deploy pages very quickly, into a very robust programming environment, and know that they will work on both a small internal site and a very large multi-server enterprise site, "right out of the box."  As a tool to do what ColdFusion is designed to do, it is very hard to beat.  There is a tremendous business need out there for "doing precisely what ColdFusion is designed to do."  It might or might not be glamorous in the eyes of a fourteen year old , but it is crucial. ... View more

In this special-case, you can use numeric-range validation. In the more general case, you can use regular expression matching (see the "mask" and "pattern" options of <cfinput>). A regular-expression is a string pattern.  You could therefore define a pattern for "six digits and nothing else." ... View more

Obviously, the right way (if you will...) to solve this kind of problem is:  <cfqueryparam>. In other words...  never allow user-contributed text to appear, in any form or under any circumstances, within an SQL query that ColdFusion ever presents to the server.  The one and only way that such text should appear is:  as a parameter. An SQL server will never interpret a query-parameter as possibly being part of the SQL string.  It will have already parsed the SQL text, already generated the execution plan, and be ready to execute it.  The string, no matter what it may contain, will only be interpreted as "character data." Every "injection attack," no matter what flavor it is, always relies upon mis-interpretation and/or mis-handling of the data that is being "injected."  But there are always ways to prevent this. It's unfortunate that the ColdFusion language has no notion of Perl's "taint mode," which actually flags individual data-values(!) as "potentially tainted" as they flow through the system. ... View more

What you should do in this case is to allow them to enter the "<"and ">" marks as-usual, then use HTMLEditFormat() during the output of those fields so that what actually winds-up being sent to the browser is the corresponding meta-characters, "&lt;" and "&gt;". The characters "<" and ">" will be entered, and they will be stored in the database in their literal form, but when outputting the values, they are escaped.  The user's browser can no longer be confused as to what it is receiving ... "what is HTML and what is not."  It will interpret the characters properly and output the text just as the user originally entered it. ... View more

Definitely so. Really, the most appropriate solution would be to stipulate that the z-order of the popup calendar-box should always be "in front of" whatever else is there.  This visual effect takes place because the z-order of the popup is behind the plane of the control itself. But, that's why sometimes you hack. ... View more

I agree with Ian. As for the "dying technology" bit ... computer software does not "die."  A piece of computer software might have a lifespan of twenty years or more.  Companies go to great lengths to evolve their technology strategy without replacing (almost) anything about it.  The software is a mission-critical investment of many millions of dollars.  And, it works. Experienced practitioners switch languages as easily as they change their hats, and they pick-up new technologies on the fly (as I did) because they have accumulated a depth of prior experience to which "the latest thing, whatever it is," always relates.  Sure, you might spend your days at a particular company working with whatever technologies they've decided to use ... and yet, you flip back-and-forth among several technologies without thinking too much about it.  ("Is a woodworker limited only to a chisel?")  ("It isn't what you got ... it's what you do with it.") You know the game:  times change, accountants do what accountants (often) do "to cut costs" and ... oops!  buh-bye!! ... and-d-d you twist in the air and land on your feet and this time it's an altogether different set of technologies, so you read a manual over the weekend and start right in.  So it goes.  From one "dying technology" to the next ... and, lo!, ain't none of 'em dead yet. ... View more

Let's face it:  there are plenty of practitioners out there who have a fairly limited breadth of experience.  They know (say...) "dot-Net and absolutely nothing else (yet)."  And, instead of being willing to embrace new ideas, new tools and techniques, they wave their hands and mumble something about "market share," as though "follow the Lemmings" was an appropriate way to make strategic technical decisions. Every company is different.  Every company's technical situation is different.  On top of this, tools are constantly evolving and growing more powerful.  The desire to exploit these new capabilities is tempered by the realization that there is no silver bullet.  When you develop a new piece of software for internal use, the maintenance and upkeep of that tool will be the predominant cost; not the cost of its initial development.  (Furthermore, you can bet your bank on the assumption that, whenever a developer (especially a younger one...) gets a better offer, it's "buh-bye!!" to the next greener pasture and you've got two weeks (if you are lucky) to manage to do without him or her.)  Amidst all of this, "you've got a business to run."  Software, and IT in general, is a cost to you. So...  when presented with a new technology option, wise companies do a thorough cost/benefit analysis -- and the outcome of such an analysis strongly favors "status quo."  It just works out that way.  (Almost) every time. I would also make this observation about ColdFusion:  "it is a shrewdly designed tool."  At first blush, you might not see what all the fuss is about.  Then you start to look more closely at its very novel approach of "just-in-time compiling" against a deep base-language (Java), and its very cleverly chosen set of tags and built-in abilities, and then you start to see a sparkling glint where you previously saw only dirt.  There are unique powers in this architecture that do not immediately jump out at you and demand, "look at me!"  Because they don't need to.  You will find them... Dot-Net is powerful:  no one will deny this.  And I am sure that almost everyone here is thoroughly versed in it as well as ColdFusion.  We are very likely responsible for simultaneously supporting both technologies.  (And probably less-than-pleased, but resigned to it.) ... View more

I agree that JavaScript is probably what you want to use here.  (There are ways to invoke it from CFML tags.)  Basically, this will avoid sending away for a new screen when the user presses the button.  Instead, the JavaScript will make the calculation and display it directly. ... View more

ColdFusion has a good set of operators for handling lists (i.e. comma-delimeted strings), arrays, and structures (i.e. hashes). One strategy that I like to use for merging and de-duping things is to put all of the strings as keys to a structure, assigning each element a dummy don't-care value.  Then, extract the list of keys from the structure. Truly, this is one of those situations where "any reasonably-clear implementation will do." ... View more

A more straightforward design may be to have a table structure like this: Classified_Ad_ID Runs_Beginning_Date Runs_Thru_Date Number_of_weeks (included for your convenience) When you insert a new ad, you are (for example) given the starting date and the number of weeks.  Based on this, you calculate the ending date. Selection of the advertisements to be shown would select ads whose starting-date is on-or-before the current date, and the ending date is on-or-after the current date. ... View more

Well ... welcome! You are in for a valuable learning experience even though (fair warning...) at first, you'll feel like you just took "a sip from a firehose." What you need to do first is to do some on-line studying so that you see more clearly just how "web applications" and "web pages" actually work.  If you are working exclusively, say, in a dot-net environment, many of these details are (by design) concealed from your concern.  In addition, in those environments both the nature of the server and the nature of the client (and the identity of the one manufacturer that produced them both...) is well known and tightly controlled. ColdFusion is an environment that is not specific to a single type or brand of server, nor is it specific as to exactly what kind of web-browser it is talking to (on what type of computer).  ColdFusion is agnostic to those things, and it definitely shows in its design. When you are doing "ordinary things" in ColdFusion, you are working with "web pages," so an HTML-browser debugging tool such as Firefox's Firebug or Internet Explorer's Developer Toolbar are essential.  Unlike dot-net, the server and the client are not "old college room-mates, both graduates of the same class and from the same university."  In ColdFusion (and in web-application environments generally), the client and the server do not presume to know each other well.  It is also important to point out that ColdFusion doesn't presume the existence of any of the Microsoft-centric, object-based (DAO, etc) interfaces that most Microsoft programmers are taught at the exclusion of all else.  The underlying technology of Adobe ColdFusion is Java.  There are other CFML implementations, mostly compatible with this, that are built on top of other things.  But none, to my limited knowledge, are built on top of Microsoft's "CLR." As I said... welcome.  You are in for a valuable learning experience.  And, in the next several days or weeks, you are about to take a good long drink from a firehose.   Fear not... "these things, too, shall pass." Also realize this:  you can "speak in terms of Microsoft this-or-that" here, and the old salts who hang around here will understand you perfectly.  It's a bit disconcerting to put-on an entirely different vendor's hat for the first time, but there are those of us here who've done it for ... well, never mind. ... View more

Let me try again ... Step one:  you go to a page by typing-in the address or following a hotlink ... ColdFusion finds the ".cfm" page that you requested and executes (or, processes) it.  Any non-CF content is copied verbatim; all of the CFML tags are executed.  The output from all this is what will be "the web page that the user sees." Since you followed a hotlink to get here, there is no "submitted FORM data."  The request is of HTTP-type "GET," not "POST."  All of these things are known to you, and to ColdFusion. Step two:  you fill out an HTML form and press "Submit" ... The same things happen as before, but this time it is an HTTP "POST" request which contains the data values you typed in.  ColdFusion makes this available in the "FORM.xxx" variable.  From this you know what values the user typed in and what button they pressed. Various Coldfusion-specific tags such as <cfform> and <cfinput> are designed to make things easier for you.  "Exactly how they work" can vary widely, but the idea is just that, "they work."  While ColdFusion is processing these and the various other CFML tags in your file, it can generate a lot of different things, in a lot of different ways that you don't have to think about, and the entire name of the game is:  "you don't have to think about it."  It might generate JavaScript ... you don't care.  It might do pre-validation of the values that the user submitted ... "so what, it just works."  ColdFusion is a power-tool designed to make easy things easy.  (And sometimes ... ... it does.) Eventually, just as before, some amount of output is generated as a result of all this, and whatever does get generated is sent back to the user as the new web page that they see. ... View more

Isn't that what the nvarchar column-type is supposed to address?  I haven't used it . . . ... View more

That is indeed what I was suggesting. but ... are you sure that the fourth parameter to Decrypt() should be 'hex'?  I don't know the answer to that.  Is this supposed to represent the encoding of the data string, or of the key? ... View more

ToeJam, when you said ... "whether to DB or FTP for later distribution" ... I instantly withdraw my comments in your case because quite clearly you are doing the right thing now in your case. It is "particularly correct," if you will, that they are creating and exchanging digital certificates so that "they can be revoked, thus rendering future data packets unusable."  The certificates would be issued with a fairly short expiration date, each one to an individual recipient and/or for a particular message type, and those would be updated on a regular basis (whether or not message compromise was suspected). Many people make the mistake of using strong encryption (like PGP) with ... (doh!!) ... "passwords."  There is a vast difference between using a "simple password" and using a digital certificate, which of course may be "protected with" a password.  You're doing it right. For your scenario, SSL is not an appropriate or a sufficient technology, and PGP/GPG (specifically "in the way that you are now using it...") unarguably and indisputably is. When information has to be handled by a non-secure store, or a multi-stage transport (like e-mail) which can and probably does make copies at each stop, then obviously the only way to handle the situation is to encrypt the message before tendering.  The mechanism obviously also needs all of the things that you are now giving it:  individually revocable certificates; validation of both message content and sender/recipient address; secure certificate/key exchange. ... View more

Hmmm... ... I remember that there is something about using redirects that will zap the "back" linkages.  But I cannot for the life of me remember what it was ... ... View more

Is there any other tool that you could use to accomplish this task?  If the ultimate objective of the task is not "to generate HTML output," it might be argued that you are simply using the wrong tool for the job -- even tough ColdFusion is, after a manner of speaking, doing it. A very definite possibility here is that you are somehow building-up data within (e.g. global...) variables or hashes (structs...) that never get cleaned away.  They never get garbage-collected because they never become "un-referenced." One strategy that might help alleviate the situation is to put all of your variable references into global structures, e.g. named GLOBAL and/or LOCAL.  Then, at the top of each processing loop, you insert a statement like:  <cfset GLOBAL = StructNew()> .  Now, explicitly, the old structure (and everything in it) is thrown-away and a new empty structure is allocated.  This happens each time through the loop.  If you need to retain the values of certain variables, add explicit code at the top of the loop that sets-aside these variables (in another, temporary, struct), resets the main global struct, puts the variables back, and then resets the temporary one before proceeding. One of the characteristics of ColdFusion, particularly when you are using CFML tags vs. <cfscript>s, is that it is very easy for everything to wind up in a global scope.  Lots of things can hang-around in memory much longer than they need to.  All of which might not matter much if you are serving web pages (and recycling the worker-threads every so often), but it becomes a crippling concern when a thread runs for a very long time, such as multiple hours. ... View more

You may find that an algorithm which accepts an RC4 key expects it to be base64 encoded.  "So," all I'm saying is, "if that is the case, then base64 encode it so that CF can immediately base64 decode it again."  In this way, you pass the necessary string into the function. ... View more

If you are dealing with a "man in the middle" situation, yes, you have to send encrypted material in such a way that it remains secure even if it is sent via carrier-pigeon. It is extremely difficult, though, to ensure truly secure communications and message-integrity in such a situation, where the messages must make "an intermediate stop" or be entrusted to a potentially un-trustworthy third party message handler (such as e-mail).  And once again, there might be a protocol such as S/MIME that would provide a "secure channel apart from the web-app itself." So...  if you can possibly avail yourself of "a secure channel apart from the web-app," one that goes without-interruption directly from source to destination and provides blanket protection to "anything and everything" that is sent along it, the situation will be much stronger than any other.  Without it, any one of the applications can be "the weakest link." A penetrator willl never attempt to hijack your system by breaking through the encryption directly, knowing that this isn't possible (unless their company name is NSA or MI6).  They'll look for holes and weaknesses in how you handled your data, or for residual files left behind by your methods, or exposure of your private keys.  They'll also learn a great deal from where the messages are going and coming.  But if the only thing that they can touch is a channel, where everything in the channel is encrypted, they're in a much more difficult situation. An encrypted channel also brings other benefits:  message integrity, no "man in the middle," and so on.  All invisibly and at no charge to you. ... View more

I use both UUID and sequential-integer columns under MSSQL all the time. When you define the integer field, specify "Identify Specification = Yes." When you define the UUID field, specify a default value of "(newid())". The only potential "gotcha" with an ORM is that it needs to be smart enough to know how to retrieve the new record's key.  Well, an SQL "Insert" query can reliably return an auto-generated integer primary key, but if you want to know the assigned UUID you're probably going to have to re-query to get it. Such is the plus-and-minus of dealing with your typical ORM.  All of them have some incarnation of this type of issue. ... View more

My experience with regard to many server applications is that "64-bit and 32-bit absolutely do not mix."  You will wind up running "32-bit servers" alongside "64-bit" ones, although these can generally be virtual-machines.  And you might well be doing this for many years to come. I guess we got accustomed to "WOW," which let us run 16-bit apps fairly seamlessly on 32-bit Windows.  But when 64-bit Windows came along, there was no "WOW32," nor will there be one.  So, you'll be running two servers.  And, licensing two servers.  Or, you might simply decide not to upgrade any of your servers to "64-bithood," given that there is precious little advantage to doing that on a garden-variety web server anyway. ... View more

A clever thing that you might be able to do here is to use a calculated field, or a database view as the case may be, which presents the desired value ("duration in minutes") as the result of any query that involves that field.  Although user code (typically...) cannot update that field, they do not have to embed "the right calculation" repetitively into their code. (And if you get funky with database "triggers," you might even be able to make the field updateable, such that the database server now does the necessary adjustments, automagically.) User code now gets the answer that they want, and the code to do it is centralized in the database server itself. ... View more