cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Exit
search
  • Global community
    • Language:
      • Deutsch
      • English
      • Español
      • Français
      • Português
  • 日本語コミュニティ
  • 한국 커뮤니티
0
Upvote

Dynamic SQL - sanitize without CFQUERYPARAM?

WolfShade
LEGEND ,
Sep 19, 2012 Sep 19, 2012

Hello, everyone.

I'm trying to build a dynamic WHERE clause for a query, based upon a user form submit.  Since I can't use CFQUERYPARAM for the whole WHERE clause, is there a way to sanitize the WHERE clause? 

I cannot use Stored Procedures, and it's an Oracle database, not my familiar MS-SQL.

Thank you,

^_^

8.6K
Translate
Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines

correct answers 1 Correct answer

12Robots
Advocate , Sep 19, 2012 Sep 19, 2012

You could use cfqueryparam if you pieced together the WHERE clause INSIDE of your cfquery. That is a much better practice overall.

<cfquery>

SELECT colA,.. colF

FROM table

WHERE 1=1

<cfif structkeyExists(FORM, "colA") AND len(FORM.colA)>

     AND colA = <cfqueryparam value="#FORM.colA#" cfsqltype="cf_sql_varchar" />

</cfif>

<cfif structkeyExists(FORM, "colB") AND len(FORM.coldB)>

     AND colB = <cfqueryparam value="#FORM.colB#" cfsqltype="cf_sql_varchar" />

</cfif>

<!--- etc, etc --->

ORDER BY colA, colD

</

...
Translate
replies 25 Replies 25
latest latest Jump to latest reply
12Robots
Advocate ,
Sep 19, 2012 Sep 19, 2012

Why can't you use cfqueryparam for a dynamic WHERE clause?  I do it all the time.

Jason

Translate
Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Resources
Documentation
ColdFusion User Guide
Open in a new window
Copyright © 2025 Adobe. All rights reserved.
Using the Community Experience League Terms of Use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices