cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
search
  • Global community
    • Language:
      • Deutsch
      • English
      • Español
      • Français
      • Português
  • 日本語コミュニティ
    Dedicated community for Japanese speakers
  • 한국 커뮤니티
    Dedicated community for Korean speakers
Exit
0
Upvote

Dynamic SQL - sanitize without CFQUERYPARAM?

WolfShade
LEGEND ,
Sep 19, 2012 Sep 19, 2012

Copy link to clipboard

Copied

Hello, everyone.

I'm trying to build a dynamic WHERE clause for a query, based upon a user form submit.  Since I can't use CFQUERYPARAM for the whole WHERE clause, is there a way to sanitize the WHERE clause? 

I cannot use Stored Procedures, and it's an Oracle database, not my familiar MS-SQL.

Thank you,

^_^

Views

6.8K

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines

correct answers 1 Correct answer

12Robots
Advocate , Sep 19, 2012 Sep 19, 2012

You could use cfqueryparam if you pieced together the WHERE clause INSIDE of your cfquery. That is a much better practice overall.

<cfquery>

SELECT colA,.. colF

FROM table

WHERE 1=1

<cfif structkeyExists(FORM, "colA") AND len(FORM.colA)>

     AND colA = <cfqueryparam value="#FORM.colA#" cfsqltype="cf_sql_varchar" />

</cfif>

<cfif structkeyExists(FORM, "colB") AND len(FORM.coldB)>

     AND colB = <cfqueryparam value="#FORM.colB#" cfsqltype="cf_sql_varchar" />

</cfif>

<!--- etc, etc --->

ORDER BY colA, colD

</

...

Votes

Translate

Translate
replies 25 Replies 25
latest latest Jump to latest reply
12Robots
Advocate ,
Sep 19, 2012 Sep 19, 2012

Copy link to clipboard

Copied

Why can't you use cfqueryparam for a dynamic WHERE clause?  I do it all the time.

Jason

Votes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Resources
Documentation
ColdFusion User Guide
Copyright © 2024 Adobe. All rights reserved.
Using the Community Experience League Terms of Use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices