MACROMEDIA COLFUSION MX 7 - INSTALLING AND USING COLDFUSION MX, Reference

Page: 351 / 1108

cfqueryparam 351
cfqueryparam
Description
Verifies the data type of a query parameter and, for DBMSs that support bind variables, enables
ColdFusion to use bind variables in the SQL statement. Bind variable usage enhances
performance when executing a
cfquery
statement multiple times.
This tag is nested within a
cfquery
tag, embedded in a query SQL statement. If you specify
optional parameters, this tag performs data validation.
Macromedia recommends that you use the
cfqueryparam
tag within every
cfquery
tag, to help
secure your databases from unauthorized users. For more information, see Security Bulletin
ASB99-04, “
Multiple SQL Statements in Dynamic Queries ,” at
www.macromedia.com/devnet/security/security_zone/asb99-04.html , and Chapter 20,
“Accessing and Retrieving Data” in ColdFusion MX Developer’s Guide .
Category
Database manipulation tags
Syntax
<cfquery
name = "query_name"
dataSource = "ds_name"
...other attributes...
SQL STATEMENT column_name =
<cfqueryparam value = "parameter value"
CFSQLType = "parameter type"
maxLength = "maximum parameter length"
scale = "number of decimal places"
null = "yes" or "no"
list = "yes" or "no"
separator = "separator character">
AND/OR ...additional criteria of the WHERE clause...
</cfquery>
See also
cfinsert
,
cfprocparam
,
cfprocresult
,
cfquery
,
cfstoredproc
,
cftransaction
,
cfupdate
;
“Enhancing security with cfqueryparam” in Chapter 20, “Accessing and Retrieving Data,” in
ColdFusion MX Developer’s Guide