Can you pass a session variable in a CFC bind?

Report · May 20, 2011

I have a page (dsp_compReqSCM.cfm) that (via a session variable) displays an application value. From this page (via a CFFORM) I would like to have that session variable passed along to a cfc(getDistinct.cfc). I can't quite get the syntax correct and am hoping to get some assistance. When I code #session.this_appl# in dsp_ReqComps.cfm, I get an error stating Element not found PTS (which is the value of session.this_appl) and that the bind cannot occur. If I pass session.this_appl (NO ##) in dsp_ReqComps.cfm, I get an error stating Element not found session and that the bind cannot occur. If I pass 'session.this_appl' or "session.this_appl" in dsp_ReqComps.cfm, I get an error stating Element not found 'session (or "session) and that the bind cannot occur.

dsp_compReqSCM.cfm calls dsp_ReqComps.cfm via cfform

<cfwindow initshow="true" center="true" width="430" height="340">
<cfform>
     <cfgrid name="componentsGrid"
             format="html"
             pagesize=10
             striperows="yes"
             bind="cfc:distinctComponents.getDistinct({cfgridpage},{cfgridpagesize},{cfgridsortcolumn},{cfgridsortdirection},#session.this_appl#})"

             selectmode="row" >
         <cfgridcolumn name="Component_type" header="Component Type" width="400">
     </cfgrid>
</cfform>

</cfwindow>

    <cfif gridsortcolumn EQ "">
   <cfset gridsortcolumn = "ASC">
</cfif>
        <cfif gridsortdir EQ "">
   <cfset gridsortdir = "ASC">
</cfif>

   <cfquery name="Qcomponents" datasource="Tax">
      select DISTINCT(component_type) from ctl_components
     where app_abbrev = #appl_in#
   </cfquery>
    <cfreturn QueryConvertForGrid(Qcomponents, page, pageSize)>
</cffunction>

</cfcomponent>

Any advice you can give is greatly appreciated!

Libby H.

Report · May 20, 2011

Hi Libby,

It looks like you're simply trying to pass the SESSION.variable into your SQL WHERE statement. You can take this out of your BIND statement, and out of your ARGUMENTS statement. Just pass it into your WHERE statement.

Just pass it into your WHERE as: (if you're passing a number)

where app_abbrev = #session.this_appl#

Just pass it into your WHERE as: (if you're passing a string)

where app_abbrev = '#session.this_appl#'

*I also note you're trying on your original bind to pass in the #se... variable. Make sure when you're building these to have opening and closing braces {...}. You don't need it, but for future reference.

Report · May 23, 2011

I gave your suggestion a try this morning, - I removed the {#session.this_appl} from the bind variable and removed the cfargument in the cffunction for the associated bind variable, and got the following error:

"Error","jrpp-1","05/23/11","10:25:56",,"Element THIS_APPL is undefined in SESSION. The specific sequence of files included or processed is: E:\inetpub\WWWROOT\Tax\distinctComponents.cfc, line: 21 "

Line 21 is where the session variable is passed to in my where statement:

          select * from ctl_components
               where app_abbrev = '#session.this_appl#'
     </cfquery>

Thanks for catching my typo in my bind example and for you suggestion. I'll keep pecking away.

Report · May 23, 2011

That message is indicating that the Session variable this_appl hasn't been set. If at the very top of dsp_ReqComps.cfm you put <cfdump var="#Session.this_appl#"> you should get an error; if not, there's something more complex going on with your application than meets the eye from the code you provided.

Once you get it such that Session.this_appl is set when you call the getDistinct method of the getDistinct CFC, your code will run. However, depending on where the value that goes into Session.this_appl comes from, your query is subject to SQL injection and that could be really, really bad. You should use <cfqueryparam>. See http://help.adobe.com/en_US/ColdFusion/9.0/CFMLRef/WSc3ff6d0ea77859461172e0811cbec22c24-7f6f.html.

Report · May 23, 2011

It looks like you're simply trying to pass the SESSION.variable into your SQL WHERE statement.

This is not great advice. One should not use external entities in a function or method if one can avoid it. Passing it in as a value here (as per the OP's original code) is the better approach here.

Back-end code should not need to know about things like user sessions and that sort of thing: that's the business of front-end code.

--

Adam

Report · May 24, 2011

Hi Adam,

Lets say I have a session variable, SESSION.ID. If I'm passing it into the BIND, I'm passing {SESSION.ID}, correct?

So then to pick this up in the function's arguments side, is this coming out as ARGUMENTS.ID?

Just want to make sure I'm headed in the right direction.

Report · May 23, 2011

If your session variable is a string, then you need to pass its value to the JS function as a string: it needs quotes around it.

As another respondent said: use a CFQUERYPARAM in your query, too. This has got nothing to do with your current predicament, but one should never hard-code dynamic values into an SQL statement.

--

Adam

Report · May 26, 2011

@Libby H

There are 2 things.

1) The name of the component the grid binds to(distinctComponents) is different from the name of the CFC(getDistinct).

2) Session variables are also available to components. There is therefore no need to pass them explicitly to a function. In any case, it is always advisable to test for the existence of a session variable before using it.

Your code would then be something like

</cfwindow>

    <cfif gridsortcolumn EQ "">
   <cfset gridsortcolumn = "ASC">
</cfif>
        <cfif gridsortdir EQ "">
   <cfset gridsortdir = "ASC">
</cfif>
<cfparam name="session.this_appl" default="your_default_value">
   <cfquery name="Qcomponents" datasource="Tax">
      select DISTINCT(component_type) from ctl_components
     where app_abbrev = #session.this_appl#
   </cfquery>
    <cfreturn QueryConvertForGrid(Qcomponents, page, pageSize)>
</cffunction>

</cfcomponent>