Skip to main content
Known Participant
June 17, 2006
Answered

Using coldfusion variables in sql queries, some unexpected results.

I've come across a somewhat perplexing problem. I'd be interested to see if the following works for other people:

<cfset sql_var = "'something','something else'">
<cfquery name="test" datasource="db">
select id from table where somename in (#sql_var#)
</cfquery>

As it is this produces a sql error - coldfusion tries to run the query as

select id from table where somename in (''something'',''something else'')

That's with double single quotes around each of the strings, even though this wasn't specified in the variable sql_var.

So I tried this:

<cfset sql_var = "something','something else">
<cfquery name="test" datasource="db">
select id from table where somename in ('#sql_var#')
</cfquery>

Where variable sql_var only has single quotes in between the two strings, and I've added single quotes to the select statement. This produces no error, but no results either. The sql being run is

select id from table where somename in ('something','something else')

Which is exactly as it should be. I copy and paste the exact same query into the database and it produces results - but when coldfusion runs the query it doesn't. Running the query with no quotes produces a sql error, which is what I wopuld expect.

Which leaves me somewhat at a loss. Anyone got any ideas?

Running CF 6.1 (I think) using a MySQL database, if that makes any difference to anything.
    This topic is closed to new replies. Start a new post to keep the conversation going.
    BKBK
    BKBKCorrect answer
    Community Expert
    June 17, 2006
    That's with double single quotes around each of the strings, even though this wasn't specified in the variable sql_var.

    In Coldfusion, 'something' and "something" are the same thing. You should expect that Coldfusion could switch from one to the other.

    Where variable sql_var only has single quotes in between the two strings, and I've added single quotes to the select statement. This produces no error, but no results either. The sql being run is
    select id from table where somename in ('something','something else')


    I don't think that is the query being run. Before passing the string, "something','something else", to the query Coldfusion will automatically escape the single-quotes on either side of the comma. That is the default behaviour. The resulting query is

    select id from table where somename in ('something'',''something else')

    To avoid these complications, use the function PreserveSingleQuotes(). Thus,

    <cfset sql_var = "'something','something else'">
    <cfquery name="test" datasource="db">
    select id from table where somename in (#preservesinglequotes(sql_var)#)
    </cfquery>

    3 replies

    BKBK
    Community Expert
    Community Expert
    June 17, 2006
    !
    Translate
    Known Participant
    June 17, 2006
    That fixed it - thank you very much!
    Translate
    BKBK
    Community Expert
    BKBKCommunity ExpertCorrect answer
    Community Expert
    June 17, 2006
    That's with double single quotes around each of the strings, even though this wasn't specified in the variable sql_var.

    In Coldfusion, 'something' and "something" are the same thing. You should expect that Coldfusion could switch from one to the other.

    Where variable sql_var only has single quotes in between the two strings, and I've added single quotes to the select statement. This produces no error, but no results either. The sql being run is
    select id from table where somename in ('something','something else')


    I don't think that is the query being run. Before passing the string, "something','something else", to the query Coldfusion will automatically escape the single-quotes on either side of the comma. That is the default behaviour. The resulting query is

    select id from table where somename in ('something'',''something else')

    To avoid these complications, use the function PreserveSingleQuotes(). Thus,

    <cfset sql_var = "'something','something else'">
    <cfquery name="test" datasource="db">
    select id from table where somename in (#preservesinglequotes(sql_var)#)
    </cfquery>

    Translate