Skip to main content
R
RichardG
Inspiring
January 11, 2013
Answered

Is CFQUERYPARAM useless without the MAXLENGTH parameter?

  • January 11, 2013
  • 1 reply
  • 3054 views

Hi,

I have some CF7 code with queries using <cfqueryparam..> that don't contain the maxlength parameter.  For example:

<cfqueryparam value="#tktNum#" cfsqltype="CF_SQL_VARCHAR" >

The queries all run fine but is this totally useless in terms of sql injection protection?  Is it doing anything helpful?

Thanks in advance,

Richard

This topic has been closed for replies.
Correct answer Adam Cameron.

No, it's not useless as far as safe-guarding against SQL injection goes because params are treated as values not SQL, so will not be executed.

The only thing the maxlength does is (as far as I know) to do length-check validation on CF's end of things before sending it to the DB... this saves a DB hit if the data wouldn't "fit" anyhow.

It's good to have the length check on if poss, but not the end of the world to not have it.

--

Adam

1 reply

A
Adam Cameron.Correct answer
Inspiring
January 11, 2013

No, it's not useless as far as safe-guarding against SQL injection goes because params are treated as values not SQL, so will not be executed.

The only thing the maxlength does is (as far as I know) to do length-check validation on CF's end of things before sending it to the DB... this saves a DB hit if the data wouldn't "fit" anyhow.

It's good to have the length check on if poss, but not the end of the world to not have it.

--

Adam

R
RichardGAuthor
Inspiring
January 11, 2013

That's excellent news.  Form fieled lengths are controlled through cfinput or input parameters so the data should be getting protected that way.  But I will be more careful going forward to use the maxlength parameters as a final precuation.

Thanks!

Richard

A
Adam Cameron.
Inspiring
January 11, 2013

Bear in mind that any validation on the clientside can be subverted very easily, so you must always do server-side validation as well.

--

Adam

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices