> I would agree with that, but you can be just as safe with > inline SQL if you scrub the variables properly. I've seen > people scream in horror over a query like this... > > WHERE id = #url.id# > > ....Until I point out... > > <cfset url.id = abs(val(trim(url.id)))> > > ....As part of the scrubbing routine. Guarantees a positive > integer value, and passes in 0 if it's a string. It's not the > best way, but for small sites it's quick, easy, and pretty safe. > CFQUERYPARAM would help also.
Since CFQUERYPARAM also generally provides a performance benefit, why wouldn't you just use that? What do you see as the advantage of your data scrubbing? > Unfortunately some people are still using access databases, > and don't have the luxury of stored procedures. Actually, you can call Access parameter queries from CF as if they were stored procedures (which, essentially, I guess they are in the broad sense of the term.) I believe Charlie Arehart wrote an article about this. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ Fig Leaf Software provides the highest caliber vendor-authorized instruction at our training centers in Washington DC, Atlanta, Chicago, Baltimore, Northern Virginia, or on-site at your location. Visit http://training.figleaf.com/ for more information! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Logware (www.logware.us): a new and convenient web-based time tracking application. Start tracking and documenting hours spent on a project or with a client with Logware today. Try it for free with a 15 day trial account. http://www.houseoffusion.com/banners/view.cfm?bannerid=67 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:222737 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
