[cfaussie] Re: coldfusion tags in a string

[Andrew Scott]

Maybe cfsavecontent it instead, that way the cfif can get processed when the
string is created.




On 5/4/07, AJ Mercer <[EMAIL PROTECTED]> wrote:
>
> I am building up an SQL string and what to include cfquery params in it.
>
> If I do a cfdump of the variable I see the string with the cfqueryparam
> tags
>
> But if I just put the variable in a cfmail, or more importantly a cfquery,
> the cfqueryparam tags disappear altogether - like they were never they. The
> rest of the sting is not alter, as in every thing after tha tag is still
> there.
>
> what is up with that?
>
> >
>


-- 



Senior Coldfusion Developer
Aegeon Pty. Ltd.
www.aegeon.com.au
Phone: +613  8676 4223
Mobile: 0404 998 273

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Andrew Scott]

scratch that...

Didn't see cfqueryparam:-(


On 5/4/07, Andrew Scott <[EMAIL PROTECTED]> wrote:
>
> Maybe cfsavecontent it instead, that way the cfif can get processed when
> the string is created.
>
>
>
>
> On 5/4/07, AJ Mercer <[EMAIL PROTECTED]> wrote:
> >
> > I am building up an SQL string and what to include cfquery params in it.
> >
> > If I do a cfdump of the variable I see the string with the cfqueryparam
> > tags
> >
> > But if I just put the variable in a cfmail, or more importantly a
> > cfquery, the cfqueryparam tags disappear altogether - like they were never
> > they. The rest of the sting is not alter, as in every thing after tha tag is
> > still there.
> >
> > what is up with that?
> >
> > > >
> >
>
>
> --
>
>
>
> Senior Coldfusion Developer
> Aegeon Pty. Ltd.
> www.aegeon.com.au
> Phone: +613  8676 4223
> Mobile: 0404 998 273




-- 



Senior Coldfusion Developer
Aegeon Pty. Ltd.
www.aegeon.com.au
Phone: +613  8676 4223
Mobile: 0404 998 273

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Andrew Scott]

But I will say that if this is inside a cffunction and its being validated
as arguments. You can skip the cfqueryparam anyway.





On 5/4/07, Andrew Scott <[EMAIL PROTECTED]> wrote:
>
> scratch that...
>
> Didn't see cfqueryparam:-(
>
>
>  On 5/4/07, Andrew Scott <[EMAIL PROTECTED]> wrote:
> >
> > Maybe cfsavecontent it instead, that way the cfif can get processed when
> > the string is created.
> >
> >
> >
> >
> > On 5/4/07, AJ Mercer <[EMAIL PROTECTED]> wrote:
> > >
> > > I am building up an SQL string and what to include cfquery params in
> > > it.
> > >
> > > If I do a cfdump of the variable I see the string with the
> > > cfqueryparam tags
> > >
> > > But if I just put the variable in a cfmail, or more importantly a
> > > cfquery, the cfqueryparam tags disappear altogether - like they were never
> > > they. The rest of the sting is not alter, as in every thing after tha tag 
> > > is
> > > still there.
> > >
> > > what is up with that?
> > >
> > > > > >
> > >
> >
> >
> > --
> >
> >
> >
> > Senior Coldfusion Developer
> > Aegeon Pty. Ltd.
> > www.aegeon.com.au
> > Phone: +613  8676 4223
> > Mobile: 0404 998 273
>
>
>
>
> --
>
>
>
> Senior Coldfusion Developer
> Aegeon Pty. Ltd.
> www.aegeon.com.au
> Phone: +613  8676 4223
> Mobile: 0404 998 273
>



-- 



Senior Coldfusion Developer
Aegeon Pty. Ltd.
www.aegeon.com.au
Phone: +613  8676 4223
Mobile: 0404 998 273

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Peter Tilbrook]

CFSAVECONTENT can be extremely useful however although for db it might prove
a security risk and I would not use it personally.

For example you can have a dynamic LOGGED IN/OUT for say menu items or
security access - but code it once and use the CFSAVECONTENT variable at
your leisure.

Wrap your code logic and output the same variable. The generated output
would adhere to what you developed within CFSAVECONTENT.

I actually use this so I am maintaining a single template (CFSWITCH
CFIF/CFELSE/CFELSEIF, etc) that can be used across the application. Logged
in - different options (same CFSAVECONTENT variable), same with Admin access
etc. Do you logic in the one template and use it across the site.

So bored now I am about to watch Superman IV - Quest for Peace - right up
there with Bloodrayne as bad movie.

-- 
Peter Tilbrook
ColdGen Internet Solutions
President, ACT and Region ColdFusion Users Group
PO Box 2247
Queanbeyan, NSW, 2620
AUSTRALIA

http://www.coldgen.com/
http://www.actcfug.com/

Tel: +61-2-6284-2727
Mob: +61-0432-897-437

Email: [EMAIL PROTECTED]
MSN Messenger Live: Desktop General

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Andrew Scott]

How can this be a security Risk


 where someField = 



 select * from some table
 #test#




On 5/4/07, Peter Tilbrook <[EMAIL PROTECTED]> wrote:
>
> CFSAVECONTENT can be extremely useful however although for db it might
> prove a security risk and I would not use it personally.
>
> For example you can have a dynamic LOGGED IN/OUT for say menu items or
> security access - but code it once and use the CFSAVECONTENT variable at
> your leisure.
>
> Wrap your code logic and output the same variable. The generated output
> would adhere to what you developed within CFSAVECONTENT.
>
> I actually use this so I am maintaining a single template (CFSWITCH
> CFIF/CFELSE/CFELSEIF, etc) that can be used across the application. Logged
> in - different options (same CFSAVECONTENT variable), same with Admin access
> etc. Do you logic in the one template and use it across the site.
>
> So bored now I am about to watch Superman IV - Quest for Peace - right up
> there with Bloodrayne as bad movie.
>
> --
> Peter Tilbrook
> ColdGen Internet Solutions
> President, ACT and Region ColdFusion Users Group
> PO Box 2247
> Queanbeyan, NSW, 2620
> AUSTRALIA
>
> http://www.coldgen.com/
> http://www.actcfug.com/
>
> Tel: +61-2-6284-2727
> Mob: +61-0432-897-437
>
> Email: [EMAIL PROTECTED]
> MSN Messenger Live: Desktop General
> >
>


-- 



Senior Coldfusion Developer
Aegeon Pty. Ltd.
www.aegeon.com.au
Phone: +613  8676 4223
Mobile: 0404 998 273

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Peter Tilbrook]

Having a go was I? My main worry would be how much info you can get with
debugging or an un-handled error. Like any variable there can be risks when
using dynamic data - especially with database and file operations.

Oh yeah. Dreamweaver CS3 is a bit dissapointing. Not much new to offer (for
the price). Gay logo. Horrible Swamp green colour scheme. Still hangs on
opening a decent Fusebox index.cfm.

This is Dreamweaver 8.5 - not 9 in my opinion. Don't chuck HomeSite for
opening certain large CFM files just yet.

-- 
Peter Tilbrook
ColdGen Internet Solutions
President, ACT and Region ColdFusion Users Group
PO Box 2247
Queanbeyan, NSW, 2620
AUSTRALIA

http://www.coldgen.com/
http://www.actcfug.com/

Tel: +61-2-6284-2727
Mob: +61-0432-897-437

Email: [EMAIL PROTECTED]
MSN Messenger Live: Desktop General

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Andrew Scott]

Peter,

No I didn't say u were having a go, but was curious how your see it as a
security risk. besides with cftry and cftransaction you capture all
exceptions anyway.

As far as DW goes, I hate DW8 and Homesite anyway Neither support TDD.


On 5/4/07, Peter Tilbrook <[EMAIL PROTECTED]> wrote:
>
> Having a go was I? My main worry would be how much info you can get with
> debugging or an un-handled error. Like any variable there can be risks when
> using dynamic data - especially with database and file operations.
>
> Oh yeah. Dreamweaver CS3 is a bit dissapointing. Not much new to offer
> (for the price). Gay logo. Horrible Swamp green colour scheme. Still hangs
> on opening a decent Fusebox index.cfm.
>
> This is Dreamweaver 8.5 - not 9 in my opinion. Don't chuck HomeSite for
> opening certain large CFM files just yet.
>
> --
> Peter Tilbrook
> ColdGen Internet Solutions
> President, ACT and Region ColdFusion Users Group
> PO Box 2247
> Queanbeyan, NSW, 2620
> AUSTRALIA
>
> http://www.coldgen.com/
> http://www.actcfug.com/
>
> Tel: +61-2-6284-2727
> Mob: +61-0432-897-437
>
> Email: [EMAIL PROTECTED]
> MSN Messenger Live: Desktop General
> >
>


-- 



Senior Coldfusion Developer
Aegeon Pty. Ltd.
www.aegeon.com.au
Phone: +613  8676 4223
Mobile: 0404 998 273

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Adam Cameron]

> But I will say that if this is inside a cffunction and its being validated
> as arguments. You can skip the cfqueryparam anyway.

Well that's only half (maybe as much as half) true.

 values are as much about query compilation and improved
DB server  erformance and memory management as they are about data
validation.

--
Adam



--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Peter Tilbrook]

My sig is too big.

Info you do not want devulged can still become available.

Look at the new DONOTRINGMEPLEASE.gov.au site. What would happen when your
server shits itself? Any guarantee that your error trapping code works? What
if it shits itself BEFORE then?

As they say. Shit happens. I had similar issues (traffic) with the ACCC GST
site years back. Thankfully nothing serious just speed issues (not a
surprise back then as everyone only had MODEMs anyway).

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Adam Cameron]

> How can this be a security Risk
>
> 
>  where someField = 
> 
>
> 
>  select * from some table
>  #test#
> 

Given it simply won't work?  The only security risk would be your JOB
security, I should think ;-)

--
Adam


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Peter Tilbrook]

True - and also differ across platforms, dbms's, even service packs.

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Peter Tilbrook]

Onya Adam!

I mean - why would you do it? Way too complicated, un-necessary etc.

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Peter Tilbrook]

On 04/05/07, Andrew Scott <[EMAIL PROTECTED]> wrote:

> How can this be a security Risk
>
> 
>  where someField = 
> 
>
> 
>  select * from some table
>  #test#
> 

How can you verify what is being fed to the database server? What if I
hacked your app and changed:

> 
>  DROP databasename
> 

You are trying to make ColdFusion a DBMS. It is, never was and likely
never will be.

Learn to use the DBMS. Learn to communicate with it using CF. Do not
use CF as a DBMS.

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[AJ Mercer]

I am using cfparam for database optermisation - param binding

There is some funky stuff going on in the application that generates sql -
not my design, but I have to work with it.


So back to the question, can cf tags be put in a string to be used in
another tag later?



On 5/4/07, Peter Tilbrook <[EMAIL PROTECTED]> wrote:
>
>
> On 04/05/07, Andrew Scott <[EMAIL PROTECTED]> wrote:
>
> > How can this be a security Risk
> >
> > 
> >  where someField = 
> > 
> >
> > 
> >  select * from some table
> >  #test#
> > 
>
> How can you verify what is being fed to the database server? What if I
> hacked your app and changed:
>
> > 
> >  DROP databasename
> > 
>
> You are trying to make ColdFusion a DBMS. It is, never was and likely
> never will be.
>
> Learn to use the DBMS. Learn to communicate with it using CF. Do not
> use CF as a DBMS.
>
> >
>


-- 
If you are not living on the edge,
You are taking up too much space.

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Andrew Scott]

Yeah I must admit after posting that, I didn't think it would work...



On 5/4/07, Adam Cameron <[EMAIL PROTECTED]> wrote:
>
>
> > How can this be a security Risk
> >
> > 
> >  where someField = 
> > 
> >
> > 
> >  select * from some table
> >  #test#
> > 
>
> Given it simply won't work?  The only security risk would be your JOB
> security, I should think ;-)
>
> --
> Adam
>
>
> >
>


-- 



Senior Coldfusion Developer
Aegeon Pty. Ltd.
www.aegeon.com.au
Phone: +613  8676 4223
Mobile: 0404 998 273

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Andrew Scott]

Thats why TDD is so much a need as it is important.



On 5/4/07, Peter Tilbrook <[EMAIL PROTECTED]> wrote:
>
> My sig is too big.
>
> Info you do not want devulged can still become available.
>
> Look at the new 
> DONOTRINGMEPLEASE.gov.ausite. What would 
> happen when your server shits itself? Any guarantee that
> your error trapping code works? What if it shits itself BEFORE then?
>
> As they say. Shit happens. I had similar issues (traffic) with the ACCC
> GST site years back. Thankfully nothing serious just speed issues (not a
> surprise back then as everyone only had MODEMs anyway).
>
>
>
> >
>


-- 



Senior Coldfusion Developer
Aegeon Pty. Ltd.
www.aegeon.com.au
Phone: +613  8676 4223
Mobile: 0404 998 273

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Adam Cameron]

> So back to the question, can cf tags be put in a string to be used in
> another tag later?

Short answer: no.

Mid-length answer:
You've got to think about the CF live cycle.  What you see as source
code isn't actually what's finally executed.  Before it's executed,
CFML is "compiled" into Java bytecode, and *that* is executed.  For
CFML tags to "run", they need to already be there at "compile
time" (as opposed to "run time", which is when your string exists).

This is the same reason why one cannot "build" CFML statements out of
other CFML statements at runtime - which is a question that does the
round on various forums every week or so - and expect the built
statements to somehow run.

Long answer:
The best you can hope for is to write your string to a file, and then
include it.  Even with CF's gains in this area over the last few
versions, this is a slow solution, as your runtime file needs to be
compiled (slow) before it's executed.

For your  situation, what I've done is to re-implement
 as a function, and include in that processing for swapping
out a token (by default, it's {cfqp}) in my SQL string for a
 tag, populating it from an array of structs also passed-
in to the function.  Someone else had written a far more elegant
solution a while back which DID allow for in-line #cfqueryParam()#
calls in the SQL string, which again was subsequently re-processed as
a  tag by the cfquery() function.  I've lost his source
code, so am in the process of re-implementing my own.  I'm 90% of the
way through it... just waiting for a spare hour to finish it.  My
development paused for reflection a bit when I found out that there
are [cough] "things on the horizon" which will make re-implementing CF
tags as functions *much* *much* *much* easier.  Once it's released.

--
Adam


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[AJ Mercer]

Thanks for the explanation Adam. Back to the drawing board...

This looks interesting

http://mkruger.cfwebtools.com/index.cfm?mode=alias&alias=no_cfqueryparam
http://mkruger.cfwebtools.com/index.cfm?mode=alias&alias=binding_oracle

eg

   DECLARE   @param1 varchar(50)
   DECLARE @param2 int = 

   set @param1 = 'joe'
   set @param2 = 

   SELECTname, Email, userId
   FROM   users
   WHERE   username = @param1
   AND  pin = @param2




On 5/5/07, Adam Cameron <[EMAIL PROTECTED]> wrote:
>
>
> > So back to the question, can cf tags be put in a string to be used in
> > another tag later?
>
> Short answer: no.
>
> Mid-length answer:
> You've got to think about the CF live cycle.  What you see as source
> code isn't actually what's finally executed.  Before it's executed,
> CFML is "compiled" into Java bytecode, and *that* is executed.  For
> CFML tags to "run", they need to already be there at "compile
> time" (as opposed to "run time", which is when your string exists).
>
> This is the same reason why one cannot "build" CFML statements out of
> other CFML statements at runtime - which is a question that does the
> round on various forums every week or so - and expect the built
> statements to somehow run.
>
> Long answer:
> The best you can hope for is to write your string to a file, and then
> include it.  Even with CF's gains in this area over the last few
> versions, this is a slow solution, as your runtime file needs to be
> compiled (slow) before it's executed.
>
> For your  situation, what I've done is to re-implement
>  as a function, and include in that processing for swapping
> out a token (by default, it's {cfqp}) in my SQL string for a
>  tag, populating it from an array of structs also passed-
> in to the function.  Someone else had written a far more elegant
> solution a while back which DID allow for in-line #cfqueryParam()#
> calls in the SQL string, which again was subsequently re-processed as
> a  tag by the cfquery() function.  I've lost his source
> code, so am in the process of re-implementing my own.  I'm 90% of the
> way through it... just waiting for a spare hour to finish it.  My
> development paused for reflection a bit when I found out that there
> are [cough] "things on the horizon" which will make re-implementing CF
> tags as functions *much* *much* *much* easier.  Once it's released.
>
> --
> Adam
>
>
> >
>


-- 
If you are not living on the edge,
You are taking up too much space.

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---

[cfaussie] Re: coldfusion tags in a string

[Rod Higgins]

I'm lost, why do you need to create temporary sp when you could create a
proper sp?
 

create or alter procedure userSP 
  @username varchar(50), 
  @pin int
 as
  SELECTname, Email, userId
  FROM   users   
  WHERE   username = @username
   AND  pin = @pin

 


  

 
or something like it??

-Original Message-
From: cfaussie@googlegroups.com [mailto:[EMAIL PROTECTED] On Behalf
Of AJ Mercer
Sent: Saturday, 5 May 2007 10:02 AM
To: cfaussie@googlegroups.com
Subject: [cfaussie] Re: coldfusion tags in a string


Thanks for the explanation Adam. Back to the drawing board...

This looks interesting

http://mkruger.cfwebtools.com/index.cfm?mode=alias
<http://mkruger.cfwebtools.com/index.cfm?mode=alias&alias=no_cfqueryparam>
&alias=no_cfqueryparam 
http://mkruger.cfwebtools.com/index.cfm?mode=alias
<http://mkruger.cfwebtools.com/index.cfm?mode=alias&alias=binding_oracle>
&alias=binding_oracle

eg


   DECLARE   @param1 varchar(50) 
   DECLARE @param2 int =  
   
   set @param1 = 'joe'
   set @param2 = 
   
   SELECTname, Email, userId
   FROM   users   
   WHERE   username = @param1
   AND  pin = @param2





On 5/5/07, Adam Cameron <[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> > wrote: 


> So back to the question, can cf tags be put in a string to be used in 
> another tag later?

Short answer: no.

Mid-length answer:
You've got to think about the CF live cycle.  What you see as source
code isn't actually what's finally executed.  Before it's executed, 
CFML is "compiled" into Java bytecode, and *that* is executed.  For
CFML tags to "run", they need to already be there at "compile
time" (as opposed to "run time", which is when your string exists). 

This is the same reason why one cannot "build" CFML statements out of
other CFML statements at runtime - which is a question that does the
round on various forums every week or so - and expect the built 
statements to somehow run.

Long answer:
The best you can hope for is to write your string to a file, and then
include it.  Even with CF's gains in this area over the last few
versions, this is a slow solution, as your runtime file needs to be 
compiled (slow) before it's executed.

For your  situation, what I've done is to re-implement
 as a function, and include in that processing for swapping
out a token (by default, it's {cfqp}) in my SQL string for a 
 tag, populating it from an array of structs also passed-
in to the function.  Someone else had written a far more elegant
solution a while back which DID allow for in-line #cfqueryParam()#
calls in the SQL string, which again was subsequently re-processed as
a  tag by the cfquery() function.  I've lost his source
code, so am in the process of re-implementing my own.  I'm 90% of the 
way through it... just waiting for a spare hour to finish it.  My
development paused for reflection a bit when I found out that there
are [cough] "things on the horizon" which will make re-implementing CF 
tags as functions *much* *much* *much* easier.  Once it's released.

--
Adam







-- 
If you are not living on the edge,
You are taking up too much space.




--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups 
"cfaussie" group.
To post to this group, send email to cfaussie@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at 
http://groups.google.com/group/cfaussie?hl=en
-~--~~~~--~~--~--~---