Skip to main content
Participant
September 29, 2023
Answered

New to ColdFusion and it is truncating the entered field value

  • September 29, 2023
  • 1 reply
  • 248 views

(fyi:  This was all created by a predicessor).

 

I have a simple intranet page that displays data pulled from a database and allows the user to delete individual entries, with a single click.  The sql delete requires UnitNumber and FleetGroup to identify the unique record.  My issue is that the CFDfg variable is truncating to 10 characters, despite the values being as long as 50 characters.  How do I get ColdFusion to pass the full FleetGroup value to MS SQL?  I ran SQL Server Profiler, which is how I know it is only getting 10 charcters of the FleetGroup value.

 

Here is the delete code.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
<table width="45%" align="center" border="1" cellspacing="0" cellpadding="0">
<td colspan="6" align="center" valign="top" nowrap><a href="/DataManager/TMReadiness.cfm?        CFAdded=AddATruck">Add A Truck</a></td>
<tr class="style6">
<td width="52%" nowrap><span class="style6"><strong>Fleetgroup</strong></span></td>
<td width="33%" nowrap><span class="style6"><strong>Truck Unit Number</strong></span></td>
<td width="15%" nowrap><strong>Delete?</strong></td>
</tr>

<cfoutput query="TRKQRY">
<tr class="style6">
<td nowrap><span class="style6">#FleetGroup#</span></td>
<td nowrap><span class="style6">#UnitNumber#</span></td>
<td class="style6"><a href="/DataManager/TMReadiness.cfm?CFAdded=DelaTruck&CFDid=#UnitNumber#&CFDfg=#FleetGroup#">Yes</a></td>
</tr>
</cfoutput>
</table>
</cfif>

 

<cfif CFAdded eq 'DelaTruck'>
<cfquery datasource="intranet" name="DelATruck" username="cwddata" password="cwdrolloff">
delete [Intranet].[dbo].[TM_Readiness_Vechicles] where UnitNumber = #URL.CFDid# and FleetGroup = #URL.CFDfg
</cfquery>
<META http-equiv="refresh" content="0; Url=/DataManager/TMReadiness.cfm?CFAdded=AddDelTruck">
</cfif>

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

 

Thanks for your help,

Andy

    This topic has been closed for replies.
    Correct answer Dave Watts

    I don't know the answer to your question. Truncating strings doesn't seem like something CF would do, all by itself. To find out more about what's going on, run the page with a long value, then view source.

     

    There are some other pretty serious things going on in the code that should be fixed immediately. First, you should never use untrusted values in an SQL query. This is a critical security vulnerability that allows SQL injection attacks. You can fix that with CFQUERYPARAM. This tells the database that those values aren't executable code. Second, you shouldn't let links that can be requested with a simple GET request change any of your data. GET requests are supposed to be idempotent, which in a nutshell means you should always get the same response. That doesn't happen if the request deletes data. I'm not going to go into a more detailed explanation now, but you can easily find out with a Google or Bing search, or ask here.

     

    Dave Watts, Eidolon LLC 

    1 reply

    Dave WattsCommunity ExpertCorrect answer
    Community Expert
    September 30, 2023

    I don't know the answer to your question. Truncating strings doesn't seem like something CF would do, all by itself. To find out more about what's going on, run the page with a long value, then view source.

     

    There are some other pretty serious things going on in the code that should be fixed immediately. First, you should never use untrusted values in an SQL query. This is a critical security vulnerability that allows SQL injection attacks. You can fix that with CFQUERYPARAM. This tells the database that those values aren't executable code. Second, you shouldn't let links that can be requested with a simple GET request change any of your data. GET requests are supposed to be idempotent, which in a nutshell means you should always get the same response. That doesn't happen if the request deletes data. I'm not going to go into a more detailed explanation now, but you can easily find out with a Google or Bing search, or ask here.

     

    Dave Watts, Eidolon LLC 

    Dave Watts, Eidolon LLC