Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Coldfusion 8 and SQL server 2008.

I've been building serveral forms that insert data into the database from external users, we have a custom built security module built by the guy who I've taken his job.

1) How can we test our HTML forms to ensure that we're protected from SQL injection attacks?

2) How do I secure CFqueries in CFC's?

3) What are some best practices in terms of SQL & Coldfusion for security?

-- A lot I know!

share|improve this question
Here's a short answer if you already know CF: – davidhaskins Jul 20 '11 at 19:41
up vote 1 down vote accepted

This article from Adobe discusses most of the issues you'll need to deal with.

The best protection against SQL injection is to use a parametric query - that is, a query that is complete and can be compiled by the SQL engine but that you attach data to after the fact. I haven't used Coldfusion in many years, but it appears that it doesn't support parametric queries - the article I linked lists some solutions to the problem.

share|improve this answer

Summarizing the answers, CFQUERYPARAM is your friend. It will automatically escape all the parameters, and speed the queries up at the same time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.