CFQUERY Datatypes and Quotes

[goxmedia]

Hello,

In CFQUERY operations, can someone advise as to the following:

1. What data types REQUIRE single quotes for UPDATE and INSERT statements?

  * We are using MS SQL 2008 R2 with CF9

2. Is it best practice to use CFQUERYPARAM for EVERY statement now days?

I searched everywhere but can't seem to find any type of reference sheet anywhere that I can use when building my statemnts.

Thanks in advance.

G.

[JMF3]

Use CFQUERYPARAM and you don't have to worry about it ...

Basically, only numbers don't use the string delimiter. Date/times

depend on how you want to format them ... again, use CFQUERYPARAM and

never worry about it again.

[-__cfSearching__-]

We are using MS SQL 2008 R2 with CF9

>> Use CFQUERYPARAM and you don't have to worry about it ...

More importantly you should be using cfqueryparam anyway to protect your queries against sql injection.

http://www.petefreitag.com/item/677.cfm

http://www.coldfusionmuse.com/index.cfm/2008/2/22/sql-injection-on-a-character-field

http://www.12robots.com/index.cfm/2008/7/30/SQL-Injection-is-only-the-beginning-ltcfqueryparamgt-is-the-easy-part

[goxmedia]

... thanks cfSarching.

[goxmedia]

... thanks JMF.

[Dan_Bracuk]

Using cfqueryparam is a good idea unless there is a reason not to.  With CF9/MS SQL those reasons will be few and far between.

[goxmedia]

... thanks Dan.