Quantcast
Viewing latest article 3
Browse Latest Browse All 21760

Re: Coldfusion 9 - prevent SQL injection while using dynamic table/view name

Thanks Charlie, that was my though initially unfortunately emp id can be a varchar.

What are the other ways coldfusion let to query dynamic sql object names without using store proc approach ?

 

I read cfqueryparam just creates placeholder and coldfusion writes value after validation in that query

So if that's correct below statement should work or break the query ?

Select columns from sometext_<cfqueryparam value='#empid#'>

 

I just want coldfusion to avoid  creating quotes around that parameter like below.

Select columns from sometext_'acb123'

 

Correct me if I'm wrong, thanks.


Viewing latest article 3
Browse Latest Browse All 21760

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>