Cfhttpparam Tag form data error

[harpreets72075604]

Hi All, Facing a weired issue in cfhttpparam, when I hard code a string value it goes without quotes: as seen in fireshark capture below:

But when this string is done dunamicly it gets wraped in "". adding Quotes makes it fail in third party REST API. see below line which adds quotes

<cfhttpparam type="formField" name="annotation" value="#some variables#">

[BKBK]

Yes, that's strange. Does the variable contain by chance an extra pair of quotes? When I did the following test, I couldn't reproduce the problem.

I placed test1.cfm and test2.cfm in the webroot, launched test1.cfm in the browser, and then examined the HTML file in the logs folder.

test1.cfm

<!--- Dynamically --->
<cfset annotation="97bb0158-d392-e9d3-7b7a-a78ec8347140">
<cfhttp url="http://127.0.0.1:8500/test2.cfm" method="post">
	<cfhttpparam type="formfield" name="annotation" value="#annotation#" encoded="false" >
	<cfhttpparam type="formfield" name="annotationVariableValueType" value="dynamically" >
</cfhttp>

<!--- Hard-coded --->
<cfhttp url="http://127.0.0.1:8500/test2.cfm" method="post">
	<cfhttpparam type="formfield" name="annotation" value="97bb0158-d392-e9d3-7b7a-a78ec8347140" encoded="false" >
	<cfhttpparam type="formfield" name="annotationVariableValueType" value="hardcoded" >
</cfhttp>
done

test2.cfm

<cfscript>	
	writedump(var=GetHttpRequestData(), format="html", output="#server.coldfusion.rootdir#\logs\HttpRequestData.html");
</cfscript>

Result:

[Dave Watts]

I'm not sure what "#some variables#" is supposed to represent. This syntax will let you include ONE expression. Just one. Maybe you can show the specific code you're trying to execute in there? Thanks in advance!

Dave Watts, Eidolon LLC

[BKBK]

<cfhttpparam type="formField" name="annotation" value="#some variables#">

By @harpreets72075604

It just occurred to me that "#some variables#" may include CFML code. That is, it may not just consist of a variable name. That would explain the presence of an extra pair of quotes.

If so, then I have 2 suggestions. You may use either:

<cfset annotationValue = code_to_evaluate_the_annotation>
<cfhttpparam type="formField" name="annotation" value="#annotationValue#">

<cfset annotationValue = code_to_evaluate_the_annotation>
<cfhttpparam type="formField" name="annotation" value=#annotationValue#>