How can I prevent SQL injection attacks?
SQL injection attacks occur when a client manipulates a web page to pass invalid data to a query. This can be down to force errors, bypass security, or even delete data. The <cfqueryparam> tag prevents SQL injection by binding values into the query; the bound values cannot be interpreted as SQL. It also results in faster queries.
<cfquery name="QCheckUser" datasource="blahblah">
SELECT *
FROM USERS
WHERE username = '#FORM.username#'
AND password = '#FORM.password#'
</cfquery>
becomes
<cfquery name="QCheckUser" datasource="blahblah">
SELECT *
FROM USERS
WHERE username = <cfqueryparam cfsqltype="cf_sql_varchar" value="#FORM.username#">
AND password = <cfqueryparam cfsqltype="cf_sql_varchar" value="#FORM.password#">
</cfquery>
In general, <cfqueryparam> should be used whenever a dynamic attribute is specified in a query.
This question was written by James Holmes
It was last updated on January 19, 2006.