August 31, 2009
Prevent sql injection attacks in Coldfusion
Ben Forta, my guru, has a fantastic article on the prevention of SQL Injection attacks. In case you don’t know what what a SQL Injection attack is, it is a very insidious code injection technique that allows someone to embed sql statements within your code.
I like to check my parameters before passing them to the database as suggested by Ben. Here’s an example that validates a paramater being passed by a URL:
<cfquery …>
SELECT *
FROM Customers
WHERE CustID=<cfqueryparam value=“#URL.CustID#” cfsqltype=“CF_SQL_INTEGER”>
</cfquery>
SELECT *
FROM Customers
WHERE CustID=<cfqueryparam value=“#URL.CustID#” cfsqltype=“CF_SQL_INTEGER”>
</cfquery>
Advertisement
