I can only figure out how to debug on the flex side

I researched refind and used this to protect my sql

<cfif REFind("^[a-zA-Z0-9]+$", arguments.field) >

<cfquery name="q" datasource="#datasource#">



update RATES set #arguments.field# = <cfqueryparam value="#arguments.value#" cfsqltype="cf_sql_float">
where currencyID =
<cfqueryparam value="#arguments.currencyID#" cfsqltype="cf_sql_integer">


</cfquery>
</cfif>

I'd use a list function myself.

var ListofFields = "field1,field2,etc";
var goodargument "false";
if ListFind(ListOfFields, arguments.field) gt 0)
goodargument = true;

Then you can use the goodargument variable to decide whether or not to run your query.

Please assure me, I can't afford a mistake here. I'm pretty sure an arbitrary string inserted into #arguments.field# could cause a breech.

Could you spoon feed me a bit of code that checks that #arguments.field# only contains alpha numeric characters, I can't be bothered relearning how to do this in CF ;-)

But I must use it on the field because that part is still vulnerable to sql injection. Am I wrong in this?

sure, but use it on the VALUE part, not the FIELD NAME.

Azadi Saryev
Sabai-dee.com
http://www.sabai-dee.com/

I isolated the problem:

This will work:

update RATES set #arguments.field# = #arguments.value#

but this will not:

update RATES set <cfqueryparam value="#arguments.field#" cfsqltype="cf_sql_varchar"> = #arguments.value#

Surly I must be able to use the
<cfqueryparam value="#arguments.field#" cfsqltype="cf_sql_varchar">
in place of
#arguments.field#
in my query as I need to protect from sql injection?

The simplest way to debug cold fusion code is with a web browser. Write a simple page that invokes your code both as a webservice and cfc and look at the debugging information.

Once you know your component works properly, don't mess with it. Subsequent problems will be something else.

No change occurs in the database when this function is called.

However if I put

update RATES set Barclays = 3

in the sql editor it works

For when using this function i get returned: update RATES set Barclays = 3



<cfquery name="q" datasource="#datasource#">
update RATES
set <cfqueryparam value="#arguments.field#" cfsqltype="cf_sql_varchar"> =
<cfqueryparam value="#arguments.value#" cfsqltype="cf_sql_float">

</cfquery>

<cfset flash.result="update RATES set #arguments.field# = #arguments.value#" >
<cfreturn flash.result>

Thanks.

As a workaround I tried returning the thing that I suspect the problem lies:

<cffunction name="updateField" access="remote" returntype="String">
<cfargument name="field" required="true" type="string">
<cfargument name="currencyName" required="true" type="string">
<!--- <cfargument name="currencyID" required="true" type="Numeric"> --->
<cfargument name="value" required="true" type="Numeric">



<cfquery name="q" datasource="#datasource#">
update tbale
set <cfqueryparam value="#arguments.field#" cfsqltype="cf_sql_varchar"> =
<cfqueryparam value="#arguments.value#" cfsqltype="cf_sql_float">
where currencyName =
<cfqueryparam value="#arguments.currencyName#" cfsqltype="cf_sql_varchar">
</cfquery>

<cfset flash.result="update RATES #arguments.field#" >
<cfreturn flash.result>
</cffunction>
but the following line does not return the correct string:

<cfset flash.result="update RATES #arguments.field#" >

I do I add arguments to the string?