Dave, Do you mind if I blog about that part where you said "Yeah, your right about that ...." That's got to be good for my cf_streetCred (ha).
-mk -----Original Message----- From: Dave Watts [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 22, 2008 7:14 PM To: CF-Talk Subject: RE: cfquery and cfstoredproc > I never disagree with you (usually a fools errand) Ha! I wish. > but I want a clarification. I think you might mean that this > particular use is safe because CF will escape the single quotes. > But the code below is vulnerable in exactly the same as a CFQUERY. > > As a test I created an SP > > ------------------------- > CREATE PROCEDURE dbo.sp_test > @iObject varchar(200) > as > > set nocount on > > select @iObject AS item > ------------------------------------ > > Then I ran the following code: > > --------------------------------------- > > <cfquery name="test" datasource="test"> > > sp_test 'bob'; update coaches set name = 'Dave Watts' where coach_id = > 1 > > </cfquery> > -------------------------------------- > Both of these statements run and the coaches table was updated. Yeah, you're right about that. If you have a numeric value in your CFQUERY, it could be broken to also contain a string. The semicolon would turn the single original stored procedure call into an SQL batch containing the stored procedure and whatever your string contained. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ Fig Leaf Software provides the highest caliber vendor-authorized instruction at our training centers in Washington DC, Atlanta, Chicago, Baltimore, Northern Virginia, or on-site at your location. Visit http://training.figleaf.com/ for more information! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;203748912;27390454;j Archive: http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:309502 Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
