A couple of approaches to order by.... http://www.coldfusionmuse.com/index.cfm/2008/7/21/SQL-injection-using-order- by
Mark A. Kruger, CFG, MCSE (402) 408-3733 ext 105 www.cfwebtools.com www.coldfusionmuse.com www.necfug.com -----Original Message----- From: Brad Wood [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 22, 2008 3:46 PM To: CF-Talk Subject: Re: cfquery and cfstoredproc (Depending > on the version of CF, cfqueryparam disables cachedwithin caching. This is true, but it doesn't prevent you from baking your own caching mechanism as many have done. In > all versions of CF, cfqueryparam effectively makes Sql Profiling with > SQL Server useless and there is no workaround. Please explain what you mean. Are you saying you can't run a trace and see your SQL running. That is certainly not true. It may complicate seeing the valuf of your input parameters. peronally I use SeeFusion to watch my SQL traffic. I can debug a single users's IP and it shows me all the parameters being passed in. > The code you show below puts single quotes around simple CF variables, > and in my book that provides pretty good protection from sql injection > attacks. I have not yet heard of a case/argument that shows that the > single quote method, when used with simple CF variables, is not safe. Now you have: http://www.codersrevolution.com/index.cfm/2008/7/13/Just-when-you-felt-safe- SQL-Injection-and-MySQL http://www.coldfusionmuse.com/index.cfm/2008/5/16/disable-backslash-escape-o n-mysql > BTW, I do not know if there is a way to safely use a CF variable as > part of an ORDER BY clause, I outlined what I believe to be the only way to this here: http://www.codersrevolution.com/index.cfm/2008/7/22/When-will-cfqueryparam-N OT-protect-me ~Brad ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;203748912;27390454;j Archive: http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:309482 Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
