SQL Injection Part II? It's a textbook example of SQL injection. I guess it's interesting if you haven't seen one before, but this isn't some new and more evil

SQL Injection Part II? It's a textbook example of SQL injection. I guess it's interesting if you haven't seen one before, but this isn't some new and more evil version of an old attack. It's just the same old attack that's been around since the beginning of SQL-backed applications. The moral of the story is to always validate user input. All these examples are in ColdFusion and for many years- going back at least 5 years ago when I used it- CF developers have known to use <cfqueryparam> to pass user data to queries. It's the CF equivalent of binding parameters to a query. Every example presented here can easily be protected against using that method. The only people that have to worry about this are the laziest of the lazy developers.