CF8, Flex 3, and Universe: Security question

I'd say the absolute majority of attacks on ColdFusion websites are to do with people doing one of two things:

1 - Not using cfqueryparam to parameterise SQL queries. Never do this:

<cfquery>

  SELECT * FROM table WHERE id = #form.id#

</cfquery>

Instead *always* do this:

<cfquery>

  SELECT * FROM table WHERE id = <cfqueryparam cfsqltype="cf_sql_numeric" value="#form.id#" />

</cfquery>

2 - Not cleaning user input, or not using htmlEditFormat() when displaying code from user input. Unless you're positive someone hasn't put a <script> tag into their input, don't do this:

<cfoutput>#user.getForename()#</cfoutput>

Doing this will turn any < or > symbols into their &gt; or &lt; HTML equivalents:

<cfoutput>#htmlEditFormat(user.getForename())#</cfoutput>

I'd say implementing both of those will cover you for the vast majority of attacks, which tend to be rare on ColdFusion sites anyway. Also I personally avoid using any ColdFusion-specific poncy stuff like CFFORMs, instead opting for basic HTML elements where possible. There was a major vuln discovered a few years ago in the FCKEditor code which is bundled into ColdFusion. Don't use the tags, and it's not a problem.

I'm sure people will have other ideas, but parameterising your code is 99% of your work done unless you're letting people upload files to your site, in which case you have all the risks associated with that.

HTH.

O.