Enhancing security with cfqueryparam
435
•
Do not use the
cfoutput
tag
query
attribute when you output the
RecordCount
or
ColumnList
property. If you do, you get one copy of the output for each row. Instead, prefix
the variable with the name of the query.
Enhancing security with cfqueryparam
Some DBMSs let you send multiple SQL statements in a single query. However, hackers might
try to modify URL or form variables in a dynamic query by appending malicious SQL statements
to existing parameters. Be aware that there are potential security risks when you pass parameters
in a query string. This can happen in many development environments, including ColdFusion,
ASP, and CGI. Using the
cfqueryparam
tag can reduce this risk.
About query string parameters
When you let a query string pass a parameter, ensure that only the expected information is passed.
The following ColdFusion query contains a WHERE clause, which selects only database entries
that match the last name specified in the LastName field of a form:
<cfquery name="GetEmployees" datasource="CompanyInfo">
SELECT FirstName, LastName, Salary
FROM Employee
WHERE LastName='#Form.LastName#'
</cfquery>
Someone could call this page with the following malicious URL:
http://myserver/page.cfm?Emp_ID=7%20DELETE%20FROM%20Employee
The result is that ColdFusion tries to execute the following query:
<cfquery name="GetEmployees" datasource="CompanyInfo">
SELECT * FROM Employee
WHERE Emp_ID = 7 DELETE FROM Employee
</cfquery>
In addition to an expected integer for the Emp_ID column, this query also passes malicious string
code in the form of a SQL statement. If this query successfully executes, it deletes all rows from
the Employee table—something you definitely do not want to enable by this method. To prevent
such actions, you must evaluate the contents of query string parameters.
Using cfqueryparam
You can use the
cfqueryparam
tag to evaluate query string parameters and pass a ColdFusion
variable within a SQL statement. This tag evaluates variable values before they reach the database.
You specify the data type of the corresponding database column in the
cfsqltype
attribute of the
cfqueryparam
tag. In the following example, because the Emp_ID column in the CompanyInfo
data source is an integer, you specify a
cfsqltype
of
cf_sql_integer
:
<cfquery name="EmpList" datasource="CompanyInfo">
SELECT * FROM Employee
WHERE Emp_ID =
<cfqueryparam value = "#Emp_ID#"
cfsqltype = "cf_sql_integer">
</cfquery>
Содержание COLDFUSION MX 61-DEVELOPING COLDFUSION MX
Страница 1: ...Developing ColdFusion MX Applications...
Страница 22: ...22 Contents...
Страница 38: ......
Страница 52: ...52 Chapter 2 Elements of CFML...
Страница 162: ......
Страница 218: ...218 Chapter 10 Writing and Calling User Defined Functions...
Страница 250: ...250 Chapter 11 Building and Using ColdFusion Components...
Страница 264: ...264 Chapter 12 Building Custom CFXAPI Tags...
Страница 266: ......
Страница 314: ...314 Chapter 14 Handling Errors...
Страница 344: ...344 Chapter 15 Using Persistent Data and Locking...
Страница 349: ...About user security 349...
Страница 357: ...Security scenarios 357...
Страница 370: ...370 Chapter 16 Securing Applications...
Страница 388: ...388 Chapter 17 Developing Globalized Applications...
Страница 408: ...408 Chapter 18 Debugging and Troubleshooting Applications...
Страница 410: ......
Страница 426: ...426 Chapter 19 Introduction to Databases and SQL...
Страница 476: ...476 Chapter 22 Using Query of Queries...
Страница 534: ...534 Chapter 24 Building a Search Interface...
Страница 556: ...556 Chapter 25 Using Verity Search Expressions...
Страница 558: ......
Страница 582: ...582 Chapter 26 Retrieving and Formatting Data...
Страница 668: ......
Страница 734: ...734 Chapter 32 Using Web Services...
Страница 760: ...760 Chapter 33 Integrating J2EE and Java Elements in CFML Applications...
Страница 786: ...786 Chapter 34 Integrating COM and CORBA Objects in CFML Applications...
Страница 788: ......
Страница 806: ...806 Chapter 35 Sending and Receiving E Mail...