Skip to main content
B
B_Bez
Participant
March 20, 2009
Question

Dynamic table name from Arguments in <cfquery />

  • March 20, 2009
  • 1 reply
  • 527 views


I'm trying to use dynamic table names in a cfc but seem to have hit upon a wall as my calling methods from flash keep hitting my _error methods - Code attached to show what I'm trying to achieve; if anyone can give me some pointers it would be a great help. I've seen numerous by using the Form with the arguments but this is coming into a gateway used by a flash component and doesn't work no matter how much I fiddle the code.

Thanks in advance

    This topic has been closed for replies.

    1 reply

    B
    B_BezAuthor
    Participant
    March 20, 2009
    <cfset var_Table = '#Arguments.tableName#' > seems to have fixed it nvm
    -
    -__cfSearching__-
    Inspiring
    March 20, 2009
    > this is coming into a gateway used by a flash component

    Then you should make certain you VAR scope all of the function local variables (including query names) to avoid race conditions.

    > SELECT * FROM #var_Table# WHERE `Object` = '#var_eNo#'

    That is a sql injection attack just waiting to happen ...
    A
    Anonymous
    March 20, 2009
    There was a time when I needed a dynamic query such as this. BUT, it is very dangerous, which is why I took a few steps to make it more secure.

    1. Always use cfqueryparam and strict datatyping
    2. Use listFindNoCase for known table names in the database e.g

    <cfset variables.tableNames = "items,products,categories,blog" />
    <cfif listContainsNoCase(variables.tableNames,lCase(trim(arguments.tableName)),",")>
    query here
    <cfelse>
    Error: Unknown table requested
    </cfif>

    Mikey
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices