Stripping CGI.HTTP_REFERER and CGI.SCRIPT_NAME in Coldfusion

Question

I have the block of code below which runs a query and checks for an existing record and runs a second insert query if no record is found.

<cffunction name="EndRequestFunc" access="public" returnType="string">
   <!---Queries Table To Get Requested Record--->
    <cfquery name="qryGetPageRecord" datasource="First_Main_Dev"   
    dbname="First_Services_Dev">
    SELECT pageName 
    FROM tblCFMPageRequest
    WHERE pageName = '#CGI.HTTP_REFERER#' AND scriptName = 
    '#CGI.SCRIPT_NAME#'
    </cfquery>
    <!---Conditional Check for record count equal to 0--->
    <cfif qryGetPageRecord.recordCount eq 0>
    <!---If record count equal to 0, recordset query executed--->
    <cfquery name="setNewRecord" datasource="First_Main_Dev" 
    dbname="First_Services_Dev">
    INSERT INTO tblCFMPageRequest
    VALUES ('#CGI.HTTP_REFERER#', '#CGI.SCRIPT_NAME#')
    </cfquery>
    </cfif>
    </cffunction>

What I need to do is strip the values of the two CGI variables of all formatting so that a value like this "example.com/portal/mypage.cfm" will be stripped of http and everything else down everything to just mypage.cfm before its inserted by the query. Any guidance would be appreciated.

Update: Thank to the advice given, I was able to eliminate the http://example.com/ portion of the URL using the ListLast function. I was short sighted in not remembering my urls have characters that need to be eliminated after the "cfm" point. Here is one of my actual results from ListLast: client_modify.cfm?uid=248&al=1&a_trigger=1.

I've tried using some other List functions in Coldfusion to no avail as of yet. Any advice on how to eliminate the bold portion of: client_modify.cfm ?uid=248&al=1&a_trigger=1 so I'm just left with a clean client_modify.cfm

Keep in mind that `HTTP_REFERRER` and `SCRIPT_NAME` can be spoofed, so this information may not always be accurate. — Scott Stroz, May 06 '15 at 03:18
As a related thought to the original question, how can I strip everything after the page name? My code is working to strip everything prior to the page name. I didn't think ahead to remember that the pages which need to be logged have parameters coming after the page name. Is there a way to trim what comes after the page name as well? Below is a result from my current code: user_modify_view.cfm?uid=248&al=1&comp_id=100. I now need to look at stripping everything after .cfm — Alex, May 06 '15 at 20:10

score 4 · Answer 1 · answered May 05 '15 at 20:03

4

Use ListLast() function with / as a delimiter. Also, always try to use cfqueryparam to put values in queries. Like this.

<cfquery name="setNewRecord" datasource="First_Main_Dev" bname="First_Services_Dev">
    INSERT INTO tblCFMPageRequest
    VALUES (<cfqueryparam cfsqltype="cf_sql_varchar" value="#ListLast(CGI.HTTP_REFERER,'/')#">, <cfqueryparam cfsqltype="cf_sql_varchar" value="#ListLast(CGI.SCRIPT_NAME,'/')#">)
</cfquery>

answered May 05 '15 at 20:03

Pankaj

1,731
1
13
15

Thank you for your assistance. I usually use cfqueryparam on my variables. I just forgot to this time. Great reminder. – Alex May 05 '15 at 20:53

score 3 · Answer 2 · answered May 05 '15 at 19:55

CGI variables shouldn't have any "formatting", so your question is a bit confusing.

If you're just looking to get the filename at the end of the string, you can use the list functions.

fileIwant = ListLast(CGI.SCRIPT_NAME,"/");

If CGI.SCRIPT_NAME is /wwwroot/example/index.cfm, fileIwant will result in index.cfm.

Have a care with the referrer, as it may not be defined and parsing it out will throw an error.

Stripping CGI.HTTP_REFERER and CGI.SCRIPT_NAME in Coldfusion

2 Answers2