How to help prevent sql injection with CF

Report · Jun 03, 2008

I'm trying to secure our site from possible SQL injection. Currently our site uses several sql select statements w/in a CFQUERY. I was able to pull extra data then intended using and input field on our site.
So how should I go about correcting this?
I have read to use cfqueryparam for all form fields will help. Is this enough. I have also read to create the script w/in the the database as Stored Procedure instead of running them from the web application.
Any help or advise would be great. Also any books written about SQL injection and CF.
Thanks!

Report · Jun 03, 2008

http://coldfusion.sys-con.com/read/165921.htm

http://coldfusion.sys-con.com/read/46358.htm

http://www.adobe.com/go/300b670e

http://www.adobe.com/devnet/coldfusion/articles/cfqueryparam.html

--
Ken Ford
Adobe Community Expert - Dreamweaver/ColdFusion
Fordwebs, LLC
http://www.fordwebs.com

"sic4730" <webforumsuser@macromedia.com> wrote in message news:g23m46$bve$1@forums.macromedia.com...
> I'm trying to secure our site from possible SQL injection. Currently our site
> uses several sql select statements w/in a CFQUERY. I was able to pull extra
> data then intended using and input field on our site.
> So how should I go about correcting this?
> I have read to use cfqueryparam for all form fields will help. Is this enough.
> I have also read to create the script w/in the the database as Stored Procedure
> instead of running them from the web application.
> Any help or advise would be great. Also any books written about SQL injection
> and CF.
> Thanks!
>

Report · Jun 03, 2008

quote:

Originally posted by: sic4730
I'm trying to secure our site from possible SQL injection. Currently our site uses several sql select statements w/in a CFQUERY. I was able to pull extra data then intended using and input field on our site.
So how should I go about correcting this?
I have read to use cfqueryparam for all form fields will help. Is this enough. I have also read to create the script w/in the the database as Stored Procedure instead of running them from the web application.
Any help or advise would be great. Also any books written about SQL injection and CF.
Thanks!

cfqueryparam will help against sql but will do nothing to protect you from other types of code injection, like javascript. There are other reasons to use it, but don't rely on it for security.

The best protection is to validate all input fields, be they form, url, cookie, etc.