Dave, I never disagree with you (usually a fools errand) but I want a clarification. I think you might mean that this particular use is safe because CF will escape the single quotes. But the code below is vulnerable in exactly the same as a CFQUERY.
As a test I created an SP ------------------------- CREATE PROCEDURE dbo.sp_test @iObject varchar(200) as set nocount on select @iObject AS item ------------------------------------ Then I ran the following code: --------------------------------------- <cfquery name="test" datasource="test"> sp_test 'bob'; update coaches set name = 'Dave Watts' where coach_id = 1 </cfquery> -------------------------------------- Both of these statements run and the coaches table was updated. So, yes it's protected in this case (because of escaping) but if the values were un sanitized integers it would be just as exposed as a regular query - right? If it looked like this: <cfquery name="test" datasource="test"> sp_test #bob_id# </cfquery> I would be able to attack it I think. Probably not as easy to get the syntax right but... Still possible. Mark A. Kruger, CFG, MCSE (402) 408-3733 ext 105 www.cfwebtools.com www.coldfusionmuse.com www.necfug.com -----Original Message----- From: Dave Watts [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 22, 2008 6:07 PM To: CF-Talk Subject: RE: cfquery and cfstoredproc > What about a semi-colon? > > Storedproc '#var1#','#var2#' ; *other code* > > Would the CFQUERY not allow this additional code to run? It wouldn't allow any of the values after the stored procedure call "storedproc" to run as code, because they would be placed in the input parameters of the stored procedure. Essentially, this has the same effect as parameterizing your query in CF. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ Fig Leaf Software provides the highest caliber vendor-authorized instruction at our training centers in Washington DC, Atlanta, Chicago, Baltimore, Northern Virginia, or on-site at your location. Visit http://training.figleaf.com/ for more information! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;203748912;27390454;j Archive: http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:309497 Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4