A hint of paranoia is a good thing when you're coding -- just ask yourself two things: where does the value from this variable come from? What could possibly go wrong if someone deliberately passed in malicious values? It's ok if they get an error message (as long as it doesn't reveal any code or cfm file paths). It's definitely not ok for them to pass in values that alter the execution of your code or gives them additional privileges.
There are a few scopes coming from the client side in CF: URL, Form, Cookie, CGI and the 'unspecified' scope (ie: just using #formfields# combined with <cfparam>. But anything you explicitly set with <cfset> is ok, because it cannot be tampered with). My thinking is 'Never trust these scopes for anything important without some validation'.
HTH
Vik
PS: poor cfqueryparam has to be the least appreciated CF tag out of all -- the only person I've seen using it at MXDU was Rob Rusher in his 'Coding for Performance' presentation. Of course if you're using CFCs and specify the type of each <cfargument> then you don't really need it. I just think it's a good habit to fall into.
Andy Welsh wrote:
Thanks for your input Viktor- just remember, no matter how evil you think you are, your every exhalation makes a flower blossom :D
Thanks for that- after doing a quick read-up on cfqueryparam, you're right; I should really implement your suggestions- thanks very much for taking the time out to tell me!
Cheers, AndyW
--- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED]
MX Downunder AsiaPac DevCon - http://mxdu.com/
