Re: CFSTOREDPROC and invalid SQL

2010-11-04 Thread Brent Nicholas
. StoredProcName / Non Mixed Case: cfset storedProcVar = SCHEMANAME.PACKAGE_NAME.STORED_PROC_NAME / And then used in: cfstoredproc procedure=#storedProcVar# datasource=#request.LOCAL_DATASOURCE# Not sure if needing/not needing the () is just common sense or not, but I got stuck on it for a bit

Re: CFSTOREDPROC and invalid SQL

2010-11-03 Thread Jason Fisher
storedProc on another schema with this method, though it requires nothing passed in. ie: this code approach works elsewhere --- cfset storedProc = FUNDING. OMGItsMixedCase() cfstoredproc procedure=#storedProc# dataSource=databasemonster debug=yes returncode=yes cfprocparam

Re: CFSTOREDPROC and invalid SQL

2010-11-03 Thread Eric Cobb
= FUNDING. OMGItsMixedCase() cfstoredproc procedure=#storedProc# dataSource=databasemonster debug=yes returncode=yes cfprocparam type=out cfsqltype=CF_SQL_VARCHAR dbvarname=datetext / /cfstoredproc The error: (nemisis) [Macromedia][Oracle JDBC Driver

CFSTOREDPROC and invalid SQL

2010-11-02 Thread Brent Nicholas
. OMGItsMixedCase() cfstoredproc procedure=#storedProc# dataSource=databasemonster debug=yes returncode=yes cfprocparam type=out cfsqltype=CF_SQL_VARCHAR dbvarname=datetext / /cfstoredproc The error: (nemisis) [Macromedia][Oracle JDBC Driver][Oracle]ORA

Re: CFSTOREDPROC and invalid SQL

2010-11-02 Thread Leigh
returncode=yes What's with the param 1 in front of the call? then another param 2?? A complete guess from a non-Oracle person, but ... could it be for the return code? ~| Order the Adobe Coldfusion Anthology now!

Re: CFSTOREDPROC and invalid SQL

2010-11-02 Thread Brent Nicholas
returncode=yes What's with the param 1 in front of the call? then another param 2?? A complete guess from a non-Oracle person, but ... could it be for the return code? Ok, I've removed returncode and debug and now have the following. cfstoredproc procedure=#storedProc# dataSource

Re: CFSTOREDPROC and invalid SQL

2010-11-02 Thread Brent Nicholas
I had incorrect information in my error in the previous two posts. It should read: The error: (nemisis) [Macromedia][Oracle JDBC Driver][Oracle]ORA-00900: invalid SQL statement The error occurred in D:\somepath\act_updateProgramFund.cfm: line 50 48 : 49 : cfstoredproc procedure

cfstoredproc timeout

2010-04-29 Thread Asaf Peleg
Hi, I want to limit the total execution time of a stored procedure being called from Coldfusion using cfstoredproc to 90 seconds. With cfquery there is a parameter timeout, but there is no equivalent in cfstoredproc. Can anyone think of an alternative to accomplishing this. The trick

Re: cfstoredproc timeout

2010-04-29 Thread Dave Watts
I want to limit the total execution time of a stored procedure being called from Coldfusion using cfstoredproc to 90 seconds.  With cfquery there is a parameter timeout, but there is no equivalent in cfstoredproc.  Can anyone think of an alternative to accomplishing this. The trick is, I

Re: CFSTOREDPROC kind of sucks

2009-08-27 Thread Tony Bentley
@outputMessage = 'Here is a detailed and useful error message' RETURN 75 -- Your special code for this error END -- otherwise... SET @outputMessage = 'Execution Successful' RETURN 0 END The cfstoredproc tag give you the return code, and you can then check

Re: CFSTOREDPROC kind of sucks

2009-08-26 Thread Dave Watts
Three issues that come to mind: You've really only listed two issues. Cannot access transaction errors because a coldfusion exception is thrown so any validation exceptions must be handled through cftry/cfcatch instead of the CFSTOREDPROC. If en error occurs in SQL, it means coldfusion

CFSTOREDPROC kind of sucks

2009-08-26 Thread Tony Bentley
Three issues that come to mind: Cannot access transaction errors because a coldfusion exception is thrown so any validation exceptions must be handled through cftry/cfcatch instead of the CFSTOREDPROC. If en error occurs in SQL, it means coldfusion throws an error too. dbvarname

Re: CFSTOREDPROC kind of sucks

2009-08-26 Thread Eric Cobb
listed two issues. Cannot access transaction errors because a coldfusion exception is thrown so any validation exceptions must be handled through cftry/cfcatch instead of the CFSTOREDPROC. If en error occurs in SQL, it means coldfusion throws an error too. This is (a) in keeping with how CF

Re: CFSTOREDPROC kind of sucks

2009-08-26 Thread Rick Root
On Wed, Aug 26, 2009 at 2:14 PM, Tony Bentleyt...@tonybentley.com wrote: dbvarname is completely useless. It would be nice to be able to send values across out of order or not send a value if it is not needed (NULL). It would also be nice to have those values in the debugging to reference.

Re: CFSTOREDPROC kind of sucks

2009-08-26 Thread Tony Bentley
Sorry, only two issues really. A real world scenario is when a user tries to insert a value that must be unique in the database. If a duplicate is found, SQL can return a reference code and a message stating that there is a duplicate found, an exception is thrown and an id is passed back -

RE: CFSTOREDPROC kind of sucks

2009-08-26 Thread brad
' RETURN 75 -- Your special code for this error END -- otherwise... SET @outputMessage = 'Execution Successful' RETURN 0 END The cfstoredproc tag give you the return code, and you can then check it for whatever problems may have occurred. You can then use

Re: CFSTOREDPROC kind of sucks

2009-08-26 Thread Dave Watts
A real world scenario is when a user tries to insert a value that must be unique in the database. If a duplicate is found, SQL can return a reference code and a message stating that there is a duplicate found, an exception is thrown and an id is passed back - RAISERROR @@ERROR. When

Re: CFSTOREDPROC kind of sucks

2009-08-26 Thread Rick Root
On Wed, Aug 26, 2009 at 4:04 PM, Tony Bentleyt...@tonybentley.com wrote: When this is thrown, the message states [Macromedia][SQLServer JDBC Driver] and then the RAISERROR message following. Nice for debugging but not so nice for passing the message and error code to a handler. I would

Problem with CFSTOREDPROC

2009-01-11 Thread Mauro Luna
Hi everybody, I have a problem with cfstoredproc and Informix database, when I invoke a stored procedure by cfstoredproc, it returns me several columns with the same name (EXPRESSION) and repeat the value of first column. I am running CFMX 8.0.1 Enterprise, with Informix 9.40 and built

Re: Problem with CFSTOREDPROC

2009-01-11 Thread Mike Chabot
with cfstoredproc and Informix database, when I invoke a stored procedure by cfstoredproc, it returns me several columns with the same name (EXPRESSION) and repeat the value of first column. ~| Adobe® ColdFusion® 8 software 8 is the most

cfqueryparam vs cfstoredproc?

2008-10-30 Thread Marie Taylore
) running CFSTOREDPROC? For a CFSTOREDPROC vs CFQUERYPARAM debate what would be the better thans on each side of the argument? A few I can think of off the top of my head would be: Stored Procedures - can contain advanced SQL procedural code. Encapsulate code outside of you application

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Adrian Lynch
: cfqueryparam vs cfstoredproc? Question... the more I read about CFQUERYPARAM the more it seems it mitigates many of the problems that using stored procedures also solves. I realize with stored procedures you have a lot more power in terms of SQL scripting, but for basic queries, is CFQUERYPARAM just as fast

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread morgan l
CFQUERYPARAM the more it seems it mitigates many of the problems that using stored procedures also solves. I realize with stored procedures you have a lot more power in terms of SQL scripting, but for basic queries, is CFQUERYPARAM just as fast as (or faster than) running CFSTOREDPROC

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Alan Rother
The only issue I have run into with CFQUERYPARAM is that is can degrade performance on dynamic queries. This is an inherent issue in what CFQUERYPARAM does, it essentially makes your queries into stored procs, if you actually watch the traffic flow through a MS SQL Server for example, you will see

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Jason Fisher
Marie, In my experience with SQL Server there is zero notable performance difference between well-formed SQL in a stored proc and the same well-formed SQL in a CFQUERY with CFQUERYPARAM: both gain from the built-in performance tuning of the data server. Also, note that you can run nearly any

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread brad
Original Message Subject: cfqueryparam vs cfstoredproc? From: Marie Taylore [EMAIL PROTECTED] I realize with stored procedures you have a lot more power in terms of SQL scripting, This is not really true. You can put anything you want in a cfquery block. temp tables, CTE's

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread brad
Let's hope you don't ever need to handle more than one result set. :) Also, that requires you get the return code manually as well. ~Brad Original Message Subject: Re: cfqueryparam vs cfstoredproc? From: morgan l [EMAIL PROTECTED] We call stored procedures using

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Jason Fisher
Alan, SQL Server will create an execution plan for each query that gets run, where the plan is specific to the final Query definition. From SQL Server's perspective, these are 2 different queries, so each gets its own plan: Query with both names: SELECT ID, FName, LName, Email FROM SomeTable

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Alan Rother
Interesting... I thought the same thing until I ran these tests. I analyzed the results with ColdFusion debugging output, the Server Monitor in CF8 Ent, SeeFusion, and watched them execute through SQL Profiler, all of them showed better execution times when I removed the CFQUERYPARAMs. Now, this

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Jason Fisher
Interesting, indeed. Wonder if there's an issue of table scan vs index and how the initial execution plans are getting cached. Definitely something to keep your eye on! Interesting... I thought the same thing until I ran these tests. I analyzed the results with ColdFusion debugging output,

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Mark Kruger
www.coldfusionmuse.com www.necfug.com -Original Message- From: Alan Rother [mailto:[EMAIL PROTECTED] Sent: Thursday, October 30, 2008 11:28 AM To: cf-talk Subject: Re: cfqueryparam vs cfstoredproc? Interesting... I thought the same thing until I ran these tests. I analyzed the results

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Craigsell
My 2 cents I use ORACLE stored procs exclusively (using a CFSTOREDPROC tag) and have found them to be great. There are things I can do in stored procs that would be difficult to do in a CFC. I can easily have multiple datasets returned in one call. And the CFPROCPARAM gives me the same

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Adrian Lynch
:45 To: cf-talk Subject: Re: cfqueryparam vs cfstoredproc? My 2 cents I use ORACLE stored procs exclusively (using a CFSTOREDPROC tag) and have found them to be great. There are things I can do in stored procs that would be difficult to do in a CFC. I can easily have multiple datasets

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread brad
steps to paramaterize it. (requires sp_executesql) FYI: My advice assumes MS SQL. ~Brad Original Message Subject: RE: cfqueryparam vs cfstoredproc? From: Adrian Lynch [EMAIL PROTECTED] Date: Thu, October 30, 2008 1:06 pm To: cf-talk cf-talk@houseoffusion.com An open question

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Adrian Lynch
/ -Original Message- From: [EMAIL PROTECTED] Sent: 30 October 2008 18:28 To: cf-talk Subject: RE: cfqueryparam vs cfstoredproc? exec() or sp_executesql You would need to pass in the arguments as a list to the procedure and then do the looping and building of a dynamic query with SQL

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Aaron Rouse
: http://adrianlynch.co.uk/post.cfm?postID=21 Adrian Building a database of ColdFusion errors at http://cferror.org/ -Original Message- From: [EMAIL PROTECTED] Sent: 30 October 2008 18:28 To: cf-talk Subject: RE: cfqueryparam vs cfstoredproc? exec() or sp_executesql You would need

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Aaron Rouse
PROTECTED] Sent: 30 October 2008 18:28 To: cf-talk Subject: RE: cfqueryparam vs cfstoredproc? exec() or sp_executesql You would need to pass in the arguments as a list to the procedure and then do the looping and building of a dynamic query with SQL. Then execute what you have created. Good

RE: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Adrian Lynch
vs cfstoredproc? I do you feel it would defeat the point? On Thu, Oct 30, 2008 at 2:19 PM, Adrian Lynch [EMAIL PROTECTED]wrote: Exactly, which kinda defeats the point I feel. I've got a few ways that I might try but for now I'm back to writing SPs. If anyone's interested, I have the full

Re: cfqueryparam vs cfstoredproc?

2008-10-30 Thread Aaron Rouse
against injection. Adrian -Original Message- From: Aaron Rouse Sent: 30 October 2008 19:52 To: cf-talk Subject: Re: cfqueryparam vs cfstoredproc? I do you feel it would defeat the point? On Thu, Oct 30, 2008 at 2:19 PM, Adrian Lynch [EMAIL PROTECTED]wrote: Exactly, which

Re: CFMX 7 - Oracle CLOB / cfstoredproc

2008-10-14 Thread pmolaro
): ** cffile action=Read file=C:\testing\Test.xml variable=variables.myXMLInput cfstoredproc procedure=TESTCLOB datasource=MYDNS cfprocparam cfsqltype=CF_SQL_CLOB type=In value=#variables.myXMLInput# cfprocparam cfsqltype=CF_SQL_CLOB type=Out variable

RE: cfquery and cfstoredproc

2008-07-23 Thread Dave Watts
Actually, I'm gonna pick on you again Dave and challenge this. (I'm hoping to add to my wall) If a someone is using MySQL ... Well, the original poster was asking about the current attack, which specifically targets MS SQL Server. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/

RE: cfquery and cfstoredproc

2008-07-23 Thread Dave Watts
Do you mind if I blog about that part where you said Yeah, your right about that That's got to be good for my cf_streetCred (ha). I don't mind, no. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ Fig Leaf Software provides the highest caliber vendor-authorized instruction

Re: writing protected CF with CFStoredProc

2008-07-23 Thread Qing Xia
Excellent points! Thanks Dave, and everyone who took the time to reply to / read this thread. Moral lessons learned: 1) Don't go crazy with tightening security around SQL statements. Only secure the vulnerable; 2) Whenever possible, think of using native CF functions to simplify code. :-) BTW,

Re: cfquery and cfstoredproc

2008-07-23 Thread Brad Wood
Actually, I'm gonna pick on you again Dave and challenge this. (I'm hoping to add to my wall) If a someone is using MySQL ... Well, the original poster was asking about the current attack, which specifically targets MS SQL Server. That might be true, but he didn't say that. He simply

writing protected CF with CFStoredProc

2008-07-22 Thread Qing Xia
that with CFStoredProc? If I understand correctly, if you want to protect calls to stored procs (from SQL injection and the like), you have to use cfstoredproc and cfprocparam instead of cfquery and cfqueryparam. But apparently, you can't indicate what parameters you're actually passing. Am I missing something? Say

RE: writing protected CF with CFStoredProc

2008-07-22 Thread Andy Matthews
with CFStoredProc Hello folks: The discussion yesterday regarding using CFqueryparam to protect sites from SQL Injection attacks got me thinking. Well, it is easy enough to use CFQUERYPARAM everywhere inside CFQUERY tags, wherever a variable is passed to the SQL query. However, how do you do

RE: writing protected CF with CFStoredProc

2008-07-22 Thread Adrian Lynch
Yup, you're making sense. The way around it is to pass NULL in using: cfprocparam null=true Adrian -Original Message- From: Qing Xia [mailto:[EMAIL PROTECTED] Sent: 22 July 2008 15:21 To: CF-Talk Subject: writing protected CF with CFStoredProc Hello folks: The discussion yesterday

Re: writing protected CF with CFStoredProc

2008-07-22 Thread morgan l
What's wrong with using: cfquery ... exec sps_testproc cfif whichvar = A @aid=cfqueryparam value=123 cfsqltype=cf_sql_integer cfelse @bid=cfqueryparam value=456 cfsqltype=cf_sql_integer /cfif /cfquery

Re: writing protected CF with CFStoredProc

2008-07-22 Thread Qing Xia
Adrian -Original Message- From: Qing Xia [mailto:[EMAIL PROTECTED] Sent: 22 July 2008 15:21 To: CF-Talk Subject: writing protected CF with CFStoredProc Hello folks: The discussion yesterday regarding using CFqueryparam to protect sites from SQL Injection attacks got me thinking

Re: writing protected CF with CFStoredProc

2008-07-22 Thread Qing Xia
True! I can certainly do this as well. On Tue, Jul 22, 2008 at 10:40 AM, morgan l [EMAIL PROTECTED] wrote: What's wrong with using: cfquery ... exec sps_testproc cfif whichvar = A @aid=cfqueryparam value=123 cfsqltype=cf_sql_integer cfelse

Re: writing protected CF with CFStoredProc

2008-07-22 Thread Rich Kroll
In your example you are altering the behavior of the query based upon input which does not affect injection attacks. The idea of protecting against injection attacks is to stop invalid values from being executed within the query/SP. Take for example this query: delete from customer where

cfquery and cfstoredproc

2008-07-22 Thread Tim Do
i have been asked to look at a possible sql injection attack. as I look through the code I see stored procs being called by using cfquery like: cfquery name=asdf datasource=asdf storedproc '#var1#', '#var2#' cfquery I've read about using cfstored procs and params to prevent

RE: cfquery and cfstoredproc

2008-07-22 Thread Mark Kruger
: cfquery and cfstoredproc i have been asked to look at a possible sql injection attack. as I look through the code I see stored procs being called by using cfquery like: cfquery name=asdf datasource=asdf storedproc '#var1#', '#var2#' cfquery I've read about using cfstored procs

RE: cfquery and cfstoredproc

2008-07-22 Thread Gaulin, Mark
PM To: CF-Talk Subject: cfquery and cfstoredproc i have been asked to look at a possible sql injection attack. as I look through the code I see stored procs being called by using cfquery like: cfquery name=asdf datasource=asdf storedproc '#var1#', '#var2#' cfquery I've read

Re: cfquery and cfstoredproc

2008-07-22 Thread Brad Wood
(Depending on the version of CF, cfqueryparam disables cachedwithin caching. This is true, but it doesn't prevent you from baking your own caching mechanism as many have done. In all versions of CF, cfqueryparam effectively makes Sql Profiling with SQL Server useless and there is no

RE: cfquery and cfstoredproc

2008-07-22 Thread Mark Kruger
] Sent: Tuesday, July 22, 2008 3:46 PM To: CF-Talk Subject: Re: cfquery and cfstoredproc (Depending on the version of CF, cfqueryparam disables cachedwithin caching. This is true, but it doesn't prevent you from baking your own caching mechanism as many have done. In all versions of CF

RE: cfquery and cfstoredproc

2008-07-22 Thread Adrian Lynch
Subject: Re: cfquery and cfstoredproc In all versions of CF, cfqueryparam effectively makes Sql Profiling with SQL Server useless and there is no workaround. Please explain what you mean. Are you saying you can't run a trace and see your SQL running. That is certainly not true. It may complicate

RE: cfquery and cfstoredproc

2008-07-22 Thread Gaulin, Mark
ticks are insufficient, so now I know.) Thanks for the info. Mark -Original Message- From: Brad Wood [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 22, 2008 4:46 PM To: CF-Talk Subject: Re: cfquery and cfstoredproc (Depending on the version of CF, cfqueryparam disables

Re: cfquery and cfstoredproc

2008-07-22 Thread Brad Wood
Thanks Adrian. That's cool. however, it is not useful DURING the execution of the SQL though correct? ~Brad - Original Message - From: Adrian Lynch [EMAIL PROTECTED] To: CF-Talk cf-talk@houseoffusion.com Sent: Tuesday, July 22, 2008 3:51 PM Subject: RE: cfquery and cfstoredproc

Re: cfquery and cfstoredproc

2008-07-22 Thread Brad Wood
- From: Gaulin, Mark [EMAIL PROTECTED] To: CF-Talk cf-talk@houseoffusion.com Sent: Tuesday, July 22, 2008 4:34 PM Subject: RE: cfquery and cfstoredproc Hi Brad Thanks for the links, those are interesting articles. ~| Adobe

RE: cfquery and cfstoredproc

2008-07-22 Thread Dave Watts
i have been asked to look at a possible sql injection attack. as I look through the code I see stored procs being called by using cfquery like: cfquery name=asdf datasource=asdf storedproc '#var1#', '#var2#' cfquery I've read about using cfstored procs and params

RE: cfquery and cfstoredproc

2008-07-22 Thread Mark Kruger
[mailto:[EMAIL PROTECTED] Sent: Tuesday, July 22, 2008 5:50 PM To: CF-Talk Subject: RE: cfquery and cfstoredproc i have been asked to look at a possible sql injection attack. as I look through the code I see stored procs being called by using cfquery like: cfquery name=asdf datasource

RE: cfquery and cfstoredproc

2008-07-22 Thread Dave Watts
What about a semi-colon? Storedproc '#var1#','#var2#' ; *other code* Would the CFQUERY not allow this additional code to run? It wouldn't allow any of the values after the stored procedure call storedproc to run as code, because they would be placed in the input parameters of the stored

RE: cfquery and cfstoredproc

2008-07-22 Thread Tim Do
Subject: RE: cfquery and cfstoredproc Dave, What about a semi-colon? Storedproc '#var1#','#var2#' ; *other code* Would the CFQUERY not allow this additional code to run? -Mark Mark A. Kruger, CFG, MCSE (402) 408-3733 ext 105 www.cfwebtools.com www.coldfusionmuse.com www.necfug.com

RE: cfquery and cfstoredproc

2008-07-22 Thread Dave Watts
So I'm hearing that it should be fine?? Somehow their database columns values were appended the following string : /titleInvalidTag src=http://1.verynx.cn/w.js;/script!-- So for example the column firstname value was John became: John/titleInvalidTag

RE: writing protected CF with CFStoredProc

2008-07-22 Thread Dave Watts
The discussion yesterday regarding using CFqueryparam to protect sites from SQL Injection attacks got me thinking. Well, it is easy enough to use CFQUERYPARAM everywhere inside CFQUERY tags, wherever a variable is passed to the SQL query. However, how do you do that with CFStoredProc

RE: cfquery and cfstoredproc

2008-07-22 Thread Mark Kruger
www.necfug.com -Original Message- From: Dave Watts [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 22, 2008 6:07 PM To: CF-Talk Subject: RE: cfquery and cfstoredproc What about a semi-colon? Storedproc '#var1#','#var2#' ; *other code* Would the CFQUERY not allow this additional code to run

RE: cfquery and cfstoredproc

2008-07-22 Thread Dave Watts
I never disagree with you (usually a fools errand) Ha! I wish. but I want a clarification. I think you might mean that this particular use is safe because CF will escape the single quotes. But the code below is vulnerable in exactly the same as a CFQUERY. As a test I created an SP

RE: writing protected CF with CFStoredProc

2008-07-22 Thread Dave Watts
Say you had a proc that looked like this: CREATE PROC sps_testproc @AID int = null, @BID int = null as IF @AID is not null SELECT @AID IF @AID is not NULL SELECT @BID If I was using CFQUERY, unprotected-style, I might write this: cfquery ...

RE: cfquery and cfstoredproc

2008-07-22 Thread Dave Watts
So I'm hearing that it should be fine?? Somehow their database columns values were appended the following string : /titleInvalidTag src=http://1.verynx.cn/w.js;/script!-- So for example the column firstname value was John became: John/titleInvalidTag

RE: cfquery and cfstoredproc

2008-07-22 Thread Mark Kruger
and cfstoredproc I never disagree with you (usually a fools errand) Ha! I wish. but I want a clarification. I think you might mean that this particular use is safe because CF will escape the single quotes. But the code below is vulnerable in exactly the same as a CFQUERY. As a test I created

Re: cfquery and cfstoredproc

2008-07-22 Thread Brad Wood
, 2008 8:58 PM Subject: RE: cfquery and cfstoredproc Dave, Do you mind if I blog about that part where you said Yeah, your right about that That's got to be good for my cf_streetCred (ha). -mk ~| Adobe® ColdFusion

Re: cfquery and cfstoredproc

2008-07-22 Thread Brad Wood
As Mark pointed out, if you did have numeric inputs in your CFQUERY tag, those would still be vulnerable. If not, though, the rest of my statement still stands. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ Actually, I'm gonna pick on you again Dave and challenge this. (I'm

CFStoredProc

2007-11-09 Thread CF Developer
This should have been simple as making a PBJ. I am calling a SP (SQL Server 2005) using the CFStoredProc function and to get the result set returned as nextval. Basically it should return an interget value

RE: CFStoredProc

2007-11-09 Thread Dave Watts
I am calling a SP (SQL Server 2005) using the CFStoredProc function and to get the result set returned as nextval. Basically it should return an interget value. ... What is it I am missing? Without seeing the SP code, who can say? My guess is that your SP is returning an output

Re: CFStoredProc

2007-11-09 Thread Bruce Sorge
It looks like you are missing the DBVAR name. cfstoredproc datasource=#application.datasource# procedure=usp_select_nextval cfprocparam type=In cfsqltype=CF_SQL_VARCHAR value=DataTrack_Block dbvarname=insertfieldnamehere cfprocresult name = nextval /cfstoredproc CF Developer wrote

Re: CFStoredProc

2007-11-09 Thread Eric Cobb
. I am calling a SP (SQL Server 2005) using the CFStoredProc function and to get the result set returned as nextval. Basically it should return an interget value. cfstoredproc datasource=#application.datasource# procedure=usp_select_nextval

Re: CFStoredProc

2007-11-09 Thread CF Developer
, November 09, 2007 8:24 AM To: CF-Talk cf-talk@houseoffusion.com Subject: Re: CFStoredProc It looks like you are missing the DBVAR name. CF Developer wrote: This should have been simple as making a PBJ. I am calling a SP (SQL Server 2005) using the CFStoredProc function and to get the result

RE: CFStoredProc

2007-11-09 Thread Brad Wood
cfstoredproc.statuscode -Original Message- From: CF Developer [mailto:[EMAIL PROTECTED] Sent: Friday, November 09, 2007 10:40 AM To: CF-Talk Subject: Re: CFStoredProc The storedProc only returns a single interget value not a database object or field. It runs a Query

Re: CFStoredProc

2007-11-09 Thread gary gilbert
If you arent returning a result set then you should use a procparam with type=out. -- Gary Gilbert http://www.garyrgilbert.com/blog ~| ColdFusion is delivering applications solutions at at top companies around the world in

Re: CFStoredProc

2007-11-09 Thread Bruce Sorge
You are right. I misread your issue. Since you are only wanting an output variable, you need to change the type to OUT and use the Variable attribute. cfprocparam cfsqltype=CF_SQL_INTEGER variable=nextval type=OUT CF Developer wrote: The storedProc only returns a single

CFStoredProc out variable

2007-10-05 Thread Richard White
Hi, i have the following code to call a stored procedure which is stored in mysql. cfstoredproc procedure=addOneToOneChildFolder datasource=portdb cfprocparam type=in cfsqltype=cf_sql_varchar value=#url.OneToOneFolder# null=no cfprocparam type=in cfsqltype=cf_sql_bigint value=1 null

Re: CFStoredProc out variable

2007-10-05 Thread Richard White
Hi Eric, thanks for your reply I did what you said but it is saying that queryResult is undefined the code i used was cfstoredproc procedure=addOneToOneChildFolder datasource=portexdb cfprocparam type=in cfsqltype=cf_sql_varchar value=Hello null=no cfprocparam type=in cfsqltype

Re: CFStoredProc out variable

2007-10-05 Thread Eric Cobb
CF returns the value of the OUT variable as a regular variable, just like you created it with cfset for example. Try this: cfstoredproc procedure=addOneToOneChildFolder datasource=portdb cfprocparam type=in cfsqltype=cf_sql_varchar value=#url.OneToOneFolder# null=no cfprocparam type

RE: CFStoredProc out variable

2007-10-05 Thread Dave Watts
Hi, i have the following code to call a stored procedure which is stored in mysql. cfstoredproc procedure=addOneToOneChildFolder datasource=portdb cfprocparam type=in cfsqltype=cf_sql_varchar value=#url.OneToOneFolder# null=no cfprocparam type=in cfsqltype=cf_sql_bigint value=1

Re: CFStoredProc out variable

2007-10-05 Thread Richard White
Thanks Dave your a superstar!!! I changed the value to variable and it worked fine :) Thanks again ~| Check out the new features and enhancements in the latest product release - download the What's New PDF now

Re: Cfstoredproc message

2007-02-28 Thread Robertson-Ravo, Neil (RX)
within this communication are not necessarily those expressed by Reed Exhibitions. Visit our website at http://www.reedexpo.com -Original Message- From: Richard Meredith-Hardy To: CF-Talk Sent: Wed Feb 28 04:58:19 2007 Subject: RE: Cfstoredproc message I suppose it's really a mssql question

Re: Cfstoredproc message

2007-02-28 Thread Janet MacKay
procedure that uses xp_cmdshell and sqlcmd/osql (sql 2005/2000) to capture the messages and return them to cfstoredproc Then parse the output messages Janet ~| ColdFusion MX7 and Flex 2 Build sales marketing dashboard RIA’s

RE: Cfstoredproc message

2007-02-27 Thread Richard Meredith-Hardy
: Cfstoredproc message Well if it is success or not then you just use the return codes. If you want a specific user defined message you will have to select it into a var and return it as an OUT or as a resultset. This e-mail is from Reed Exhibitions (Gateway House, 28 The Quadrant, Richmond

Re: Cfstoredproc message

2007-02-27 Thread Dinner
If you use java DB stuff, I assume it would be available... Probably not from the built in CF DB stuff tho. :-/ On 2/27/07, Richard Meredith-Hardy [EMAIL PROTECTED] wrote: Not quite what I'm looking for, I think. This is actually a sp which contains a RESTORE DATABASE command and I'm

RE: Cfstoredproc message

2007-02-27 Thread Richard Meredith-Hardy
I suppose it's really a mssql question of trapping the generated message(s) and putting them in a var which can be returned to CF. How to do it though? -Original Message- From: Dinner [mailto:[EMAIL PROTECTED] Sent: 28 February 2007 00:38 To: CF-Talk Subject: Re: Cfstoredproc

Cfstoredproc message

2007-02-26 Thread Richard Meredith-Hardy
Simple question, I hope How does one get back to CF the message a stored proc normally puts in the messages window when you run it in SQL Server management studio or enterprise manager? Thanks in advance Richard (I've hunted around but difficult to search for the word 'message'...)

Re: Cfstoredproc message

2007-02-26 Thread Robertson-Ravo, Neil (RX)
are not necessarily those expressed by Reed Exhibitions. Visit our website at http://www.reedexpo.com -Original Message- From: Richard Meredith-Hardy To: CF-Talk Sent: Tue Feb 27 06:45:39 2007 Subject: Cfstoredproc message Simple question, I hope How does one get back to CF the message a stored proc

Re: cfstoredproc vs cfquery

2007-02-25 Thread Robertson-Ravo, Neil (RX)
Feb 24 22:46:09 2007 Subject: RE: cfstoredproc vs cfquery Thanks for your input, Dave. My concern is the processing overhead that is incurred by using CFSTOREDPROC. Do you know of any way to access multiple recordsets in CFQUERY? As it stands now, CFQUERY only returns the 1st recordset while

RE: cfstoredproc vs cfquery

2007-02-24 Thread Dave Watts
Thanks for your input, Dave. My concern is the processing overhead that is incurred by using CFSTOREDPROC. Do you know of any way to access multiple recordsets in CFQUERY? As it stands now, CFQUERY only returns the 1st recordset while ignoring the rest. The ability to pull multiple

Re: cfstoredproc vs cfquery

2007-02-23 Thread Sapporo Sapporo
Thanks for your input, Dave. My concern is the processing overhead that is incurred by using CFSTOREDPROC. Do you know of any way to access multiple recordsets in CFQUERY? As it stands now, CFQUERY only returns the 1st recordset while ignoring the rest. The ability to pull multiple recordsets

cfstoredproc vs cfquery

2007-02-22 Thread Bobby Hartsfield
# / Or cfstoredproc datasource=mydatasource procedure=GetAllResults cfprocresult name=myquery / /cfstoredproc cfdump var=#myQuery# / CFquery seems to be faster to me. I just wondered what everyone else thought about it and if there was an advantage or disadvantage either way that I don’t know about. Oh, I

RE: cfstoredproc vs cfquery

2007-02-22 Thread Ian Skinner
The only one I can think of, but then I don't use SP's very often; IIRC is that the cfstoredProc tag can handle more complex procedures. -- Ian Skinner Web Programmer BloodSource www.BloodSource.org Sacramento, CA - | 1 | | - Binary Sudoku

RE: cfstoredproc vs cfquery

2007-02-22 Thread Bobby Hartsfield
None come to mind that can't be executed via cfquery. What do you mean by more complex? -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.441 / Virus Database: 268.18.3/697 - Release Date: 2/22/2007 11:55 AM

RE: cfstoredproc vs cfquery

2007-02-22 Thread Leitch, Oblio
cfstoredproc will allow you to get back multiple resultsets. If you've got the latest updates (and the release notes are correct), they've finally fixed the 'annoymous' resultset issue, allowing un-numbered cfprocresults. -Original Message- From: Bobby Hartsfield [mailto:[EMAIL

  1   2   3   4   5   >