3 ms·
It's not a great example as it's trying to be ultra simple for first steps. There's a lot of built in security to Lucee/CF but for a query I'd always be doubly
by dominicr 8y ago
It's not a great example as it's trying to be ultra simple for first steps.
There's a lot of built in security to Lucee/CF but for a query I'd always be doubly sure and explicitly state the parameter data type as well and that'll definitely block SQL injections. So this code would be:
queryExecute(
"select * from employee where id= :itemID"
{ itemID = { value=arguments.itemID, cfsqltype="cf_sql_varchar", list=true } }
);
- bdcravens 8y agoThat works, though I think most developers are drawn to the markup style <cfquery> (I've been building CFML apps since 1999, and I don't know if I've ever seen queryExecute in the wild)
- cjcampbell 8y agoI've seen both in security reviews, primarily driven by where the code fits in the application. The more modern apps that I've come across (with stronger coding standards) restrict tag-based code to view templates.