ColdFusion SQL Security

It’s common when working on a web application to interact with a database to read, insert, update, or delete data. In doing so you must take care when using variables in your SQL. The input may be coming from a search form or passed in the URL, but wherever it comes from there is a risk of SQL Injection, Cross Site Scripting or other attacks on your system. ColdFusion provides a few helpful tools for preventing people from executing malicious SQL queries or executing JavaScript injected into your database. One is the cfqueryparam tag. Assuming we set first_name = “Kevin” This would look something like this SELECT u.first_name, u.last_name FROM users u WHERE u.first_name = <cfqueryparam cfsqltype=”CF_SQL_VARCHAR” value=”#first_name#”> This will […]

A Quick Note on XMLSearch.

For a long time, we have considered the use of XMLSearch slow compared to working through an xml object as a standard ColdFusion structure. However, recently we have discovered that XMLSearch is actually comparable in speed to the structured approach and it was just our way of using it that was causing the slowdowns. It turns out that that we were using the “//” XPath operator at the beginning of our calls to XMLSearch regardless of where the XMLDoc object that we were supplying was pointing to. ¬†This would cause the search function to go to the root of the document and search the whole tree. ¬† Removing the “//” operator from the XPath portion of the call forces ColdFusion […]

Time Zones and Countries

I needed a quick list of countries and time zones and I wanted to add it to my database so I could manipulate it easily for a new application we’re developing (details on that coming soon). I looked around but didn’t find what I wanted so after a bit of searching I took a few static select lists and copied them into Excel. I then imported the lists into my database using ColdFusion. In case they help anyone I’ve made the lists available here as CSV files. Time Zones (.csv, 4 KB) Countries (.csv, 4 KB)

Dynamic Datasources in ColdFusion MX 7

I spent some time recently trying to track down how to create a database and datasource in ColdFusion without going into the ColdFusion Adminstrator interface and doing in manually. I found plenty of articles and documentation on how this was done in ColdFusion 5 and notes that it had changed but nothing on how. Now that I’ve got it working I’d like to share how I did it in case anyone else is looking for help with this.