Dedicated Server Hosting

The recent injection attacks that have been seen against Coldfusion coded sites takes advantage of vulnerabilities in improperly coded sites. These attacks can be mitigated by using cfqueryparam within your cfquery statements. This function will force your input to be of a certain type, eliminating the possibility of a malicious user from entering SQL statements.

Below are some steps which will help you out to protect the ColdFusion code from SQL injection :-

Note: Use this function whenever you process dynamic data from a form or URL.

<cfqueryparam value="#URL.data" cfsqltype="cf_sql_integer">

The above example will take data from a URL and verify the data is an integer. If it is not, it will display an error message.

Social Bookmarking

Tweet This