0

In ColdFusion 9, the following cfquery worked:

<cfquery>
    SELECT someField 
    FROM    someTable 
    WHERE   IPADDRESS = "#CGI.REMOTE_ADDR#"
</cfquery>

After upgrading to ColdFusion 2018, the query no longer works. However, it does work if I replace the double quotes with single quotes; i.e., '#CGI.REMOTE_ADDR#' or 'CGI.REMOTE_ADDR' Did something change in newer versions of ColdFusion?

SOS
  • 6,430
  • 2
  • 11
  • 29
spackman
  • 1
  • 1
  • Use cfqueryparam instead and you won't have to worry about quotes ;-) Could you elaborate on "doesn't work"? Also, which dbms and datasource type? Is it throwing an error ... what's the error? Side note, the 2nd example would never work unless the column value contained the actual letters "CGI......". – SOS Feb 08 '19 at 02:08
  • Better use cfqueryparam or you are subjecting your queries to sql injection hacks. The query above is extremely unsafe. – Redtopia Feb 08 '19 at 04:48
  • SQL languages normally use the single quote for string/varchar delimiters. Even though you should be using cfqueryparam (security and in some cases better performance), the query above should be OK because it is using a variable from the cgi scope. If it was from the form/url scope you'd be hacked very quickly. – Scott Jibben Feb 09 '19 at 21:15

0 Answers0