Skip to main content
C
ciaranarcher
Known Participant
November 11, 2010
Question

Using cfqueryparam with a ColdFusion HQL query

  • November 11, 2010
  • 2 replies
  • 4512 views

I am using a HQL query to get a bunch of state objects like so:

    <cfquery name="LOCAL.qStates" dbtype="hql">

        from States where countryID = #ARGUMENTS.countryID#

        order by name asc

    </cfquery>

This works fine. However, I was brought up well and I want to use cfqueryparam, ideally like so:

   <cfquery name="LOCAL.qStates" dbtype="hql">

        from States

        where countryID = <cfqueryparam cfsqltype="cf_sql_integer" value="#ARGUMENTS.countryID#" />

        order by name asc

    </cfquery>

But this throws an error:

    [empty string] java.lang.NullPointerException at org.hibernate.impl.AbstractQueryImpl.verifyParameters(AbstractQueryImpl.java:353) at org.hibernate.impl.AbstractQueryImpl.verifyParameters(AbstractQueryImpl.java:323) at org.hibernate.impl.QueryImpl.list(QueryImpl.java:98) at coldfusion.orm.hibernate.HibernatePersistenceManager._executeHQL(HibernatePersistenceManager.java:822) at coldfusion.orm.hibernate.HibernatePersistenceManager.executeHQL(HibernatePersistenceManager.java:751) at ....

Anyone know how to get around this and use cfqueryparam with cfquery HQL queries?

Thanks in advance!

PS: Also posted on SatckOverflow here.

    This topic has been closed for replies.

    2 replies

    A
    Adam Cameron.
    Inspiring
    November 11, 2010

    Do you need to parameterise dynamic values in an HQL statement?  I mean... you're not passing it to the DB, you're passing it to Hibernate.

    Have you checked to see that Hibernate doesn't handle the parameterisation automatically for you?  IE: what's the resultant SQL sent to the DB without attempting to put our <cfqueryparam> tags in?

    --

    Adam

    12Robots
    12Robots
    Participating Frequently
    November 11, 2010

    With HQL Hibernate does NOT handle parameterization for you. you must do it yourself. And yes, you need to do it. HQL can be injected just like SQL.

    http://www.12robots.com/index.cfm/2009/11/19/ORM-Hibernate-Injection--Security-Series-14

    With the other ORM methods, params are handled for you. You only need to param HQL yourself.

    A
    Adam Cameron.
    Inspiring
    November 11, 2010

    Cool: good to know.  Pity it possibly doesn't work in CF, eh?

    --

    Adam

    12Robots
    12Robots
    Participating Frequently
    November 11, 2010

    Take off the Datatype, it's not required and hibernate probably does not understand them.

    Jason

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices