createObject work around?

Unfortunatly the answer is to go with a hosting Plan and|or Provider that allows the use of the desired functionality OR do without the functionality.

The reason that createObject() or any similar functionality is often disallowed on many shared plans is that it is difficult to limit what type of objects are accessed.  If your client could access his createObject("java","javax.crypto.spec.SecretKeySpec") objects, he or another user could also access the createobject("java", "coldfusion.server.ServiceFactory") object.  And this object pretty much would give that user compete access to the ColdFusion applicaiton server and all the clients on the shared system using it.

I realise that "don't use godaddy" is not very helpful advice, but I think that's about the best advice you're gonna get.  From a technological POV, I think you're sunk.  From a moral point of view, it's clear that godaddy do not want you using Java objects, so you shouldn't use them if you are going to be using their service (you will have agreed to this in your T&Cs).  It would be a) disingenuous of you; b) violate your T&Cs if you were to circumvent the intent of their restrictions, and they'd probably be able to axe your site immediately if they found out, if that's how they felt like reacting.

That said: any half-decent CF provider will have long since removed the need for that sort of disabling-tags carry-on, and you should vote with your feet / cheque book.

--

Adam