(Depending > on the version of CF, cfqueryparam disables cachedwithin caching.
This is true, but it doesn't prevent you from baking your own caching mechanism as many have done. In > all versions of CF, cfqueryparam effectively makes Sql Profiling with > SQL Server useless and there is no workaround. Please explain what you mean. Are you saying you can't run a trace and see your SQL running. That is certainly not true. It may complicate seeing the valuf of your input parameters. peronally I use SeeFusion to watch my SQL traffic. I can debug a single users's IP and it shows me all the parameters being passed in. > The code you show below puts single quotes around simple CF variables, > and in my book that provides pretty good protection from sql injection > attacks. I have not yet heard of a case/argument that shows that the > single quote method, when used with simple CF variables, is not safe. Now you have: http://www.codersrevolution.com/index.cfm/2008/7/13/Just-when-you-felt-safe-SQL-Injection-and-MySQL http://www.coldfusionmuse.com/index.cfm/2008/5/16/disable-backslash-escape-on-mysql > BTW, I do not know if there is a way to safely use a CF variable as part > of an ORDER BY clause, I outlined what I believe to be the only way to this here: http://www.codersrevolution.com/index.cfm/2008/7/22/When-will-cfqueryparam-NOT-protect-me ~Brad ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;203748912;27390454;j Archive: http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:309480 Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
