RE: CFQUERY accessing MS SQL DB on another CF server

2005-03-05 Thread James Holmes
Unless they are using sandboxing on CF Enterprise, like ay decent ISP should. -Original Message- From: S. Isaac Dealey [mailto:[EMAIL PROTECTED] Sent: Sunday, 6 March 2005 3:23 To: CF-Talk Subject: RE: CFQUERY accessing MS SQL DB on another CF server [snip] Many shared hosting

RE: CFQUERY accessing MS SQL DB on another CF server

2005-03-05 Thread James Holmes
Well, you can't do it in the cfquery tag, so it's no way. -Original Message- From: Nick Baker [mailto:[EMAIL PROTECTED] Sent: Sunday, 6 March 2005 3:13 To: CF-Talk Subject: RE: CFQUERY accessing MS SQL DB on another CF server CFAdmin's instructions are to provid

RE: CFQUERY accessing MS SQL DB on another CF server

2005-03-05 Thread S . Isaac Dealey
happen to be formulaic. but I digress... The connectionstring attribute of cfquery was (and I'm sure someone will correct me if I'm wrong) an element of what were referred to as "dsn-less connections". That is, you could connect to a database without first creating a DSN i

RE: CFQUERY accessing MS SQL DB on another CF server

2005-03-05 Thread Nick Baker
> >Warmest Regards, > >Phillip B. Holmes > > > >-Original Message- >From: Nick Baker [mailto:[EMAIL PROTECTED] >Sent: Sunday, March 06, 2005 12:46 AM >To: CF-Talk >Subject: CFQUERY accessing MS SQL DB on another CF server > >MX 6.1 > >In some of t

RE: CFQUERY accessing MS SQL DB on another CF server

2005-03-05 Thread Phillip B. Holmes
Talk Subject: CFQUERY accessing MS SQL DB on another CF server MX 6.1 In some of the earlier versions you could query a db on other servers around the Internet. V 6 and later (I think) changed up http://www.houseoffusion.com/banners/view.cfm?bannerid=67 Message: http://www.houseoffusion.com/lists

RE: CFQUERY accessing MS SQL DB on another CF server

2005-03-05 Thread James Holmes
Add the server as a datasource. -Original Message- From: Nick Baker [mailto:[EMAIL PROTECTED] Sent: Sunday, 6 March 2005 2:46 To: CF-Talk Subject: CFQUERY accessing MS SQL DB on another CF server MX 6.1 In some of the earlier versions you could query a db on other servers around the

CFQUERY accessing MS SQL DB on another CF server

2005-03-05 Thread Nick Baker
MX 6.1 In some of the earlier versions you could query a db on other servers around the Internet. V 6 and later (I think) changed up http://www.houseoffusion.com/banners/view.cfm?bannerid=49 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:197599 Archives: http://www.houseoffusion.com/cf

Re: cfquery help

2005-03-03 Thread Claude Schneegans
>>the only changes CF will make is to add a semicolon to the end of the query, Plus eventually escape single quotes in strings. -- ___ REUSE CODE! Use custom tags; See http://www.contentbox.com/claude/customtags/tagstore.cfm (Please send any spam to this add

RE: cfquery help

2005-03-03 Thread Justin D. Scott
> hi - just wondering of I can include server specific > SQL in a cfquery tag? I want to use some of MySQL's > row locking features with an InnoDB table. ColdFusion will take whatever you pass in and send it off to the database driver selected for your datasource. Assuming you'

cfquery help

2005-03-03 Thread Brant Winter
hi - just wondering of I can include server specific SQL in a cfquery tag? I want to use some of MySQL's row locking features with an InnoDB table. Can I include the MySQL lock commands in the cfquery tag before an update stat

AW: How u convert this cfquery to TSQL for MS SQL stored procedure

2005-02-21 Thread Gert Franz
-statement yet. BTW: Anyone care to see how Ben Forta did in Switzerland. Just goto www.railo.ch/gallery -Ursprüngliche Nachricht- Von: Pardeep Singh [mailto:[EMAIL PROTECTED] Gesendet: Montag, 21. Februar 2005 20:32 An: CF-Talk Betreff: How u convert this cfquery to TSQL for MS SQL stored

Re: How u convert this cfquery to TSQL for MS SQL stored procedure

2005-02-21 Thread Bryan Stevenson
Pardeepthe query is already in T-SQLI think what you are asking is how to handle dynamic variables in T-SQL (currently this is done via CF). That said...my conditional logic in TSQL is shall we say...not up to snuff ;-) Cheers Bryan Stevenson B.Comm. VP & Director of E-Commerce Develop

RE: How u convert this cfquery to TSQL for MS SQL stored procedure

2005-02-21 Thread Eric Creese
Okay I will give it a try, By the way my name is Eric, who is Ed? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, February 21, 2005 3:03 PM To: CF-Talk Subject: Re: How u convert this cfquery to TSQL for MS SQL stored procedure Hi Ed, Thanks for the

Re: How u convert this cfquery to TSQL for MS SQL stored procedure

2005-02-21 Thread pardeep
D]> To: "CF-Talk" Sent: Monday, February 21, 2005 12:44 PM Subject: RE: How u convert this cfquery to TSQL for MS SQL stored procedure > may not have to do that if you try the following > > > select * > from profiles > where 0=0 > > >

RE: How u convert this cfquery to TSQL for MS SQL stored procedure

2005-02-21 Thread Eric Creese
lk Subject: How u convert this cfquery to TSQL for MS SQL stored procedure Does anyone know how to convert this cfquery to TSQL so it can be executed through a stored procedure instead in MS SQL 2000? The first condition just sees if a var exists and makes sure its not null, the second one doe

How u convert this cfquery to TSQL for MS SQL stored procedure

2005-02-21 Thread Pardeep Singh
Does anyone know how to convert this cfquery to TSQL so it can be executed through a stored procedure instead in MS SQL 2000? The first condition just sees if a var exists and makes sure its not null, the second one does the same thing but feeds the query a list: select * from profiles where

Re: Preventing Malicious Sql without cfquery param

2005-02-06 Thread Les Mizzell
Heh - OT, but I've got a couple of very insistent spammers that I'm just dieing to try some of this stuff out on their order forms... -- --- Les Mizzell ~| Logware (www.logware.us): a new and convenient web-based time t

RE: Preventing Malicious Sql without cfquery param

2005-02-06 Thread Ewok
e simple than a cfqueryparam? -Original Message- From: Bud [mailto:[EMAIL PROTECTED] Sent: Sunday, February 06, 2005 7:23 AM To: CF-Talk Subject: RE: Preventing Malicious Sql without cfquery param > > Strings are within single quotes. Can you tamper with '#url.emp_id#

RE: Preventing Malicious Sql without cfquery param

2005-02-06 Thread Bud
> > Strings are within single quotes. Can you tamper with '#url.emp_id#' >> if emp_id is text?? > >; DROP * FROM TableName WHERE 1=1 -- If that is within single quotes, why wouldn't SQL read that simply as a string of text? -- Bud Schneehagen - Tropical Web Creations, Inc. _/_/_/_/_/_/_/_/_/

Re: OT: CFQuery SQL Scope of return?

2005-02-04 Thread Umer Farooq
SELECT TOP x.. However.. MS SQL Server does not support select range type quries. If your table does not contain lot of data.. look at CFOUTPUT controls.. otherwise.. SQL StoredProc would give you good results.. Nick Baker wrote: > MS SQL > CFMX 6.1 > > How do you limit the score of info ret

RE: CFQuery SQL Scope of return?

2005-02-04 Thread Dave Watts
> MS SQL > CFMX 6.1 > > How do you limit the score of info returned? > or > The equivalent of MySQL > LIMIT #StartRow#, #NumberRows# To get the first 5 rows: SELECT TOP 5 ... To get the second 5 rows: SELECT TOP 5 ... FROM ... WHERE field NOT IN (SELECT TOP 5 ...) Dave Watts, CTO, Fig

OT: CFQuery SQL Scope of return?

2005-02-04 Thread Nick Baker
MS SQL CFMX 6.1 How do you limit the score of info returned? or The equivalent of MySQL LIMIT #StartRow#, #NumberRows# Thanks, Nick ~| Discover CFTicket - The leading ColdFusion Help Desk and Trouble Ticket applicat

Re: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread Rick Root
James Holmes wrote: > SELECT BLOG_CONFIG.*, 'foo' as foo FROM BLOG_CONFIG > > And you thought that would be hard, didn't you... Hehheheh.. I'll keep that in mind! You know, making BlogCFM work for 5 different databases has been an interesting exercise. Once it's done, I'm hoping to talk the al

RE: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread James Holmes
SELECT BLOG_CONFIG.*, 'foo' as foo FROM BLOG_CONFIG And you thought that would be hard, didn't you... -Original Message- From: Rick Root [mailto:[EMAIL PROTECTED] Sent: Saturday, 5 February 2005 12:04 To: CF-Talk Subject: Re: Creating Oracle Functions in CFQUERY revisit

Re: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread Rick Root
James, that did the trick! Crazy, in ALL other SQL queries sent via CFQUERY, if you end them in ;, you get an "Invalid Character" error... Here's a question, Mr. Oracle Man... Why can't I do this? SELECT *, 'foo' as foo FROM BLOG_CONFIG It's easy enough to

RE: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread James Holmes
It may be, but the function still works anyway. -Original Message- From: Janet Schmitt [mailto:[EMAIL PROTECTED] Sent: Friday, 4 February 2005 11:42 To: CF-Talk Subject: Re: Creating Oracle Functions in CFQUERY revisited YEAR is a reserved word in Oracle. Try a different name for the

Re: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread Janet Schmitt
YEAR is a reserved word in Oracle. Try a different name for the function. Janet. At 09:55 AM 2/4/2005 -0500, you wrote: >All four queries execute fine... no errors... then when I try to access >the Year() function, I still get the error: > >[Macromedia][Oracle JDBC Driver][Oracle]ORA-06575: Pac

Re: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread Rick Root
James Holmes wrote: > Hmm, does the Month function work? As for the error (or lack of it), it > might be some weird driver issue. I'll try your exact code in a sec and post > back. Let me know... I'm running CFMX 6.1 Updater 1 on Windows, and using the default Oracle JDBC Driver, connecting to an

RE: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread James Holmes
5 11:08 To: CF-Talk Subject: Re: Creating Oracle Functions in CFQUERY revisited James Holmes wrote: > You stil have AS in the Year Fn > > RETURN NUMBER AS BEGIN > > Should be IS Changed, still getting the same error. As a side note, why wouldn't invalid syntax cause the

RE: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread RADEMAKERS Tanguy
SUBSTR(OBJECT_NAME,1,25) OBJECT_TYPESTATUS - -- --- C_TO_FFUNCTION VALID SQL> >-Original Message- >From: Rick Root [mailto:[EMAIL PROTECTED] >Sent: Friday, February 04, 2005 4:08 PM >To: CF-Talk >Subject: Re: Creating Oracle Functions i

RE: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread James Holmes
ating Oracle Functions in CFQUERY revisited James Holmes wrote: > You stil have AS in the Year Fn > > RETURN NUMBER AS BEGIN > > Should be IS Changed, still getting the same error. As a side note, why wouldn't invalid syntax cause the create function stat

Re: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread Rick Root
James Holmes wrote: > You stil have AS in the Year Fn > > RETURN NUMBER AS BEGIN > > Should be IS Changed, still getting the same error. As a side note, why wouldn't invalid syntax cause the create function statement to error? - Rick ~~~

RE: Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread James Holmes
You stil have AS in the Year Fn RETURN NUMBER AS BEGIN Should be IS -Original Message- From: Rick Root [mailto:[EMAIL PROTECTED] Sent: Friday, 4 February 2005 10:55 To: CF-Talk Subject: Creating Oracle Functions in CFQUERY revisited Okay... James suggested yesterday that I create my

Creating Oracle Functions in CFQUERY revisited

2005-02-04 Thread Rick Root
Okay... James suggested yesterday that I create my oracle functions inside a CFC, and make sure to put the SQL to create the function all on one line. But it's not helping.. Here is my code: test.cfm Oracle functions created.

Re: Creating Oracle Functions with CFQUERY

2005-02-03 Thread James Holmes
it runs off the edge of your editor) or 2) as an include - cfinclude the cfquery tag into the body of the CFC method and the carriage returns in the PL/SQL won't screw things up. This is one of those cool practical joke bugs with CF that are fun at parties, but I m serious - try it and it

Re: Creating Oracle Functions with CFQUERY

2005-02-03 Thread Janet Schmitt
Also, make sure that the data source you are using allows you to create objects. Under allowed SQL, the create box needs to be checked. >On Thu, 03 Feb 2005 11:05:01 -0500, Rick Root <[EMAIL PROTECTED]> >wrote: > > This was in another thread but I wanted to post it to a separarate > > thread s

Re: Creating Oracle Functions with CFQUERY

2005-02-03 Thread Andrew Eakett
Rick, Just tried it out, and I'm with Tanguy... It works if you leave out the "/". The Oracle user I tried with had the resource and connect roles granted to it. This was on Oracle 8.1.7.4. Andrew On Thu, 03 Feb 2005 11:05:01 -0500, Rick Root <[EMAIL PROTECTED]> wrote: > This was in another

RE: Creating Oracle Functions with CFQUERY

2005-02-03 Thread RADEMAKERS Tanguy
user_objects where object_type = 'FUNCTION' and object_name = 'YEAR' select year(sysdate) from dual /t >-Original Message- >From: Rick Root [mailto:[EMAIL PROTECTED] >Sent: Thursday, February 03, 2005 5:05 PM >To: CF-Talk >Subject: Creating Oracle Functions

Creating Oracle Functions with CFQUERY

2005-02-03 Thread Rick Root
This was in another thread but I wanted to post it to a separarate thread so more people might see it.. I need to create oracle functions from within CFML. Ie: CREATE OR REPLACE FUNCTION year (MyDate DATE) RETURN NUMBER IS BEGIN RETURN extract(YEAR FROM MyDate); END year; / It doesn't g

Invisible character in a CLOB --> pb in CFquery

2005-02-03 Thread Nath Arduini
Hi, I have a problem with a SELECT cfquery selecting a CLOB field in an Oracle database. The problem comes from this character, which is invisible but at then of almost all my fields : see the attachment for the character. The query never ends and the page never displays... only on Coldfusion MX

Re: Preventing Malicious Sql without cfquery param

2005-02-02 Thread Jeff Congdon
I did Dave, and it's a good summary, especially of the more advanced topics like extended procedures and activex integration. It (http://www.nextgenss.com/papers/advanced_sql_injection.pdf for those new to the thread) also serves as yet another reminder to never use the default error message

RE: Preventing Malicious Sql without cfquery param

2005-02-02 Thread Dave Watts
> Indeed. I see myself beginning to get flogged over this, but > I'm only trying to make this point: "it's not that easy". > Somebody said "show me an example", and somebody else said > "here". I'm simply saying that the example is flawed, and I > am CERTAINLY not saying "don't worry about

Re: Preventing Malicious Sql without cfquery param

2005-02-02 Thread Jeff Congdon
Indeed. I see myself beginning to get flogged over this, but I'm only trying to make this point: "it's not that easy". Somebody said "show me an example", and somebody else said "here". I'm simply saying that the example is flawed, and I am CERTAINLY not saying "don't worry about injection"

Re: Preventing Malicious Sql without cfquery param

2005-02-02 Thread Jochem van Dieten
Tyler Fitch wrote: > > Assume the big bad user put a ' after your (value). > > SELECT * FROM table1 WHERE field1 = 'some value';DELETE FROM table2 > WHERE 1 = 1 --' And that won't work because CF automatically doubles all single quotes. If it were that easy nobody needed to be convinced of the

Re: Preventing Malicious Sql without cfquery param

2005-02-02 Thread Tyler Fitch
Jeff, Assume the big bad user put a ' after your (value). SELECT * FROM table1 WHERE field1 = 'some value';DELETE FROM table2 WHERE 1 = 1 --' I don't think any of the examples posted yet explicitly had it in there, but give it a try, crackers will. cfqueryparam, t On Wed, 02 Feb 2005 13:28:15

Re: Preventing Malicious Sql without cfquery param

2005-02-02 Thread Jeff Congdon
Adam, first off - I agree with you entirely, one should not be playing this game. I don't post in an attempt to convince the original poster to not use queryparam, only as a response to what I saw to be an incorrect answer. With that in mind, I still cannot get it to work. "select * from (tab

RE: Preventing Malicious Sql without cfquery param

2005-02-02 Thread Dave Watts
> which would say '(value);DROP * FROM tableName where 1 = 1' > > ... which would be harmless. at least by sql server, it > would be treated as one long string to insert/update/whatever. You might want to read this: http://www.nextgenss.com/papers/advanced_sql_injection.pdf Dave Watts, CTO, Fi

Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Adam Haskell
you missed the -- at the endthat comments anything trailing on that line...like the ending single quote. i am going to echo quite a few people don't play the game with a hacker, hackers are always half a step ahead and if they fall behind they will find a way to get ahead... Adam H On Tue, 01

Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Jeff Congdon
which would say '(value);DROP * FROM tableName where 1 = 1' ... which would be harmless. at least by sql server, it would be treated as one long string to insert/update/whatever. -jc Michael T. Tangorre wrote: >>Strings are within single quotes. Can you tamper with '#url.emp_id#' >>if emp_id

Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Will Tomlinson
Is a stored procedure an option? ~| Logware (www.logware.us): a new and convenient web-based time tracking application. Start tracking and documenting hours spent on a project or with a client with Logware today. Try it for fre

SQL Injection Attacks by Example Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Keith Gaughan
Jochem van Dieten wrote: > gabriel l smallman wrote: > >> >> would the statement made by rick still hold true though. The >>attack would need to be able to close the single quotes to embed an attack. > > > And how hard is that exactly? Don't go and play 'I know more > about SQL then you do

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Michael T. Tangorre
> Strings are within single quotes. Can you tamper with '#url.emp_id#' > if emp_id is text?? ; DROP * FROM TableName WHERE 1=1 -- ~| Logware (www.logware.us): a new and convenient web-based time tracking application. Start t

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Ian Skinner
Strings are within single quotes. Can you tamper with '#url.emp_id#' if emp_id is text?? -- Yes, easily and with great destructive potential. -- Ian Skinner Web Programmer BloodSource www.BloodSource.org Sacramento, CA "C code. C code run. Run code run. Please!" - Cynthia Dunning

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Dave Watts
> Strings are within single quotes. Can you tamper with > '#url.emp_id#' if emp_id is text?? Yes. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ Fig Leaf Software provides the highest caliber vendor-authorized instruction at our training centers in Washington DC, Atlanta, Chicago,

Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Jochem van Dieten
Bud wrote: >>> I use val() >>> >>> select * from emp where emp_id=#val(url.emp_id)# >>> >>> Anything not numeric will be dropped. A totally non-numeric >>> value will return 0. >>> >>> For dates I use ODBCDateFormat. >> >> That's great for numbers, but what about strings? > > Strings are withi

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Bud
> > I use val() >> >> select * from emp where emp_id=#val(url.emp_id)# >> >> Anything not numeric will be dropped. A totally non-numeric >> value will return 0. >> >> For dates I use ODBCDateFormat. > >That's great for numbers, but what about strings? > >Dave Watts, CTO, Fig Leaf Software >htt

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Dave Watts
> I have tried this but ran into casting issues. MX would make > the wrong guess at the data type of the column. In that case, I'd recommend that you just put the query objects within the Session, Application or Server scopes as appropriate. If you're writing the application yourself, this is usu

Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Jochem van Dieten
gabriel l smallman wrote: > > >> would the statement made by rick still hold true though. The > attack would need to be able to close the single quotes to embed an attack. And how hard is that exactly? Don't go and play 'I know more about SQL then you do' with a hacker. You lose. Jochem

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread gabriel l smallman
> Because the query may be called with the cachedwithin attribute which > doesn't play nice with queryparams. I haven't seen a easy work around > for this issue yet. You can cache your query within the Session, Application or Server scopes, or you might be able to cache a query of that query usi

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Dave Watts
> Because the query may be called with the cachedwithin > attribute which doesn't play nice with queryparams. I haven't > seen a easy work around for this issue yet. You can cache your query within the Session, Application or Server scopes, or you might be able to cache a query of that query us

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Dave Watts
> I use val() > > select * from emp where emp_id=#val(url.emp_id)# > > Anything not numeric will be dropped. A totally non-numeric > value will return 0. > > For dates I use ODBCDateFormat. That's great for numbers, but what about strings? Dave Watts, CTO, Fig Leaf Software http://www.figleaf

Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Bud
>gabriel l smallman wrote: >> Realistically, coldfusion automatically escapes any single quotes >> >> But if im not mistaken(easily could be) someone might not need to be able to >> stuff in single quotes to tamper? I think they need the semi colon and >> parens to insert a sub query to blow

Re: Preventing Malicious Sql without cfquery param

2005-02-01 Thread Rick Root
emp_id=;drop table emp" (with the appropriate url encoding. But for strings... select * from products where title like '%#url.criteria#%' It's not really a problem because like I said, coldfusion automatically escapes single quotes within variabl

RE: Preventing Malicious Sql without cfquery param

2005-02-01 Thread gabriel l smallman
>> why can't you use cfqueryParam??? Because the query may be called with the cachedwithin attribute which doesn't play nice with queryparams. I haven't seen a easy work around for this issue yet. >> Realistically, coldfusion automatically escapes any single quotes ANYWAY... But if im not mist

Re: Preventing Malicious Sql without cfquery param

2005-01-31 Thread Rick Root
Realistically, coldfusion automatically escapes any single quotes ANYWAY... so FOO LIKE '%#url.somevar#%' should be safe anyway, unless you're using PreservESingleQuotes somewhere. Still... use cfqueryparam, it's good for you. - Rick ~

Re: Preventing Malicious Sql without cfquery param

2005-01-31 Thread Matt Robertson
Joe, This is what I get for pasting snippets without writing up the background properly... This was for an ntext field. Thats where this started worming its way into my code. SQL Server was barfing on searches where I was searching thru a page's contents as part of a global site search. Can y

Re: Preventing Malicious Sql without cfquery param

2005-01-31 Thread Adam Haskell
in aswer to yuor question you can do something like DECLARE @myvar varchar(100); SET @myvar = '%#Url.SearchString#%' Select ... >From ... Where p.Keywords LIKE @myvar The syntax may not be 100% but I hope that gets the idea across...and just to echo everyone else...why can't you use cfqueryPara

Re: Preventing Malicious Sql without cfquery param

2005-01-31 Thread Joe Rinehart
Matt, I use LIKE all the time in MS SQL with CFQueryParam...just to make sure my head is screwed on straight, I just ran the following against an nvarchar column: where SomeColumn like -joe On Mon, 31 Jan 2005 11:17:27 -0800, Matt Robertson <[EMAIL PROTECTED]> wrote: > > Why can't y

Re: Preventing Malicious Sql without cfquery param

2005-01-31 Thread Matt Robertson
> Why can't you use cfqueryparam? I have actually experienced this myself with the following, and only on MS SQL Server. The same statement works great in mySQL, Access and Oracle. In the code below, if we are running SQL Server (localgrid.usedb=2) execution branches to bypass cfqueryparam. I'v

Re: Preventing Malicious Sql without cfquery param

2005-01-31 Thread Rick Root
gabriel l smallman wrote: > Hey all, anyone got a simple method to protect a var used in a where clause > where we cannot use cfqueryparam? Why can't you use cfqueryparam? > OR P.Keywords LIKE '%#Url.SearchString#%' OR P.KEYWORDS LIKE - rick ~~

Re: Preventing Malicious Sql without cfquery param

2005-01-31 Thread Jochem van Dieten
gabriel l smallman wrote: > Hey all, anyone got a simple method to protect a var used in a where clause > where we cannot use cfqueryparam? > > Example: > > OR P.Keywords LIKE '%#Url.SearchString#%' Use cfqueryparam: P.Keywords LIKE Jochem ~~~

Preventing Malicious Sql without cfquery param

2005-01-31 Thread gabriel l smallman
Hey all, anyone got a simple method to protect a var used in a where clause where we cannot use cfqueryparam? Example: OR P.Keywords LIKE '%#Url.SearchString#%' And search string can be entered by the public thanks ~| Disco

Re: CFQuery Question

2005-01-28 Thread Adam Haskell
Select Distinct * INTO #temp >From mytable truncate TABLE my table Insert into myTable Select * >From #temp or thats the psuedo code for it...not sure the exact syntax is right Adam H On Fri, 28 Jan 2005 08:14:14 -0800 (PST), Discover Antartica <[EMAIL PROTECTED]> wrote: > Does anyone kn

CFQuery Question

2005-01-28 Thread Discover Antartica
Does anyone know how to delete duplicate records from a table and leave only one record in the table using . ~| Logware (www.logware.us): a new and convenient web-based time tracking application. Start tr

RE: CFQUERY -->-> Stored Procedure

2005-01-24 Thread Robertson-Ravo, Neil (RX)
: CF-Talk Subject: Re: CFQUERY -->-> Stored Procedure >The Proc is looking for a like within the string '[EMAIL PROTECTED]' - you >will need >to do the following: Excellent, that works perfectly, thanks! I just figured out full text searching last night, and think I'm

Re: CFQUERY -->-> Stored Procedure

2005-01-24 Thread Will Tomlinson
>The Proc is looking for a like within the string '[EMAIL PROTECTED]' - you >will need >to do the following: Excellent, that works perfectly, thanks! I just figured out full text searching last night, and think I'm going to create a catalog for this db and give it a shot. Thanks again for you

RE: CFQUERY -->-> Stored Procedure

2005-01-24 Thread Robertson-Ravo, Neil (RX)
RCH + '%' GROUP BY tblprodmodelcodes.prodmodelcode, tblprodmodelcodes.prodmodeltitle,tblprodmodelcodes.prodcategory, tblprodmodelcodes.prodsellprice -Original Message- From: Will Tomlinson [mailto:[EMAIL PROTECTED] Sent: 24 January 2005 02:23 To: CF-Talk Subject: CFQUERY -->-> Stored Procedure

CFQUERY -->-> Stored Procedure

2005-01-23 Thread Will Tomlinson
I'm converting most of my select queries to stored procedures and hit a snag with one of them. This cfquery works and gives me the desired results for the term "peace": SELECT tblprodmodelcodes.prodmodelcode, tblprodmodelcodes.prodmodeltitle,tblprodmodelcod

Re: Multiple INSERTS- one cfquery?

2005-01-14 Thread Jochem van Dieten
Will Tomlinson wrote: > On my clothing database, I have a situation where I have to delete from one > FK table, then the PK table. I do it in one cfquery like so: > > > DELETE FROM dbo.tblavailablecolors WHERE prodID='#URL.ID#'; > DELETE FROM dbo.tblpr

Re: Multiple INSERTS- one cfquery?

2005-01-14 Thread Will Tomlinson
>thats my thinking as well will >so if i have 1 product in 1 table then i dont have to do a looping delete as >well >but what do i know? I've figured out you HAVE to be signed up in the CF-Crackpipe list! I'M JOKING!! heeheh.. Thanks for your sugg's. :) Will

Re: Multiple INSERTS- one cfquery?

2005-01-14 Thread Will Tomlinson
>I hope you're cfparam'ing those queries ! :) > Yes I've used them. But I've just started with stored procedures, so right now I'm only comfy building it the old amateur way, making it work, then converting everything to sp's. Once I have a good handle on them I'll build them from the start.

Re: Possible problem of CFQUERY and ntext fields

2005-01-13 Thread Stavros Tekes
Thanks Joe! This was the sollution to the problem! Stavros ~| Find out how CFTicket can increase your company's customer support efficiency by 100% http://www.houseoffusion.com/banners/view.cfm?bannerid=49 Message: http://www.

RE: Multiple INSERTS- one cfquery?

2005-01-13 Thread Marlon Moyer
[mailto:[EMAIL PROTECTED] > Sent: Thursday, January 13, 2005 9:32 PM > To: CF-Talk > Subject: Multiple INSERTS- one cfquery? > > On my clothing database, I have a situation where I have to delete from > one FK table, then the PK table. I do it in one cfquery like so: > &

Re: Multiple INSERTS- one cfquery?

2005-01-13 Thread dave
13 Jan 2005 23:31:37 -0400 >On my clothing database, I have a situation where I have to delete from one FK >table, then the PK table. I do it in one cfquery like so: > > > DELETE FROM dbo.tblavailablecolors WHERE prodID='#URL.ID#'; > DELETE FROM dbo.tblproducts WHERE pr

Re: Multiple INSERTS- one cfquery?

2005-01-13 Thread Paul Hastings
off these. > I started thinking about my product insertion scenario. It runs though 4 > inserts with multiple cfquerys on one page. Why couldn't I place all of them > into one cfquery? Wouldn't it execute f

Multiple INSERTS- one cfquery?

2005-01-13 Thread Will Tomlinson
On my clothing database, I have a situation where I have to delete from one FK table, then the PK table. I do it in one cfquery like so: DELETE FROM dbo.tblavailablecolors WHERE prodID='#URL.ID#'; DELETE FROM dbo.tblproducts WHERE prodID='#URL.ID#' I start

Re: Possible problem of CFQUERY and ntext fields

2005-01-13 Thread Joe Rinehart
supposed to be huge, I noticed that there are some possible > limitations on CF. > > The whole issue popped up, when I tried to insert a very big string in that > field (45536 character long). Although cfquery executed the UPDATE clause > with no exceptions, when I tried to retrieve

RE: Possible problem of CFQUERY and ntext fields

2005-01-13 Thread Pascal Peters
Did you check "Enable long text retrieval (CLOB)." In your datasource?? Pascal > -Original Message- > From: Stavros Tekes [mailto:[EMAIL PROTECTED] > Sent: 13 January 2005 11:35 > To: CF-Talk > Subject: Possible problem of CFQUERY and ntext fields > > Hi

Possible problem of CFQUERY and ntext fields

2005-01-13 Thread Stavros Tekes
, when I tried to insert a very big string in that field (45536 character long). Although cfquery executed the UPDATE clause with no exceptions, when I tried to retrieve a record (using cfquery again), I only managed to get the first 32000 characters. I run the update SQL string on the SQL Query

Re: cfmx cfquery dbtype=

2005-01-07 Thread Dina Hess
Thanks, Dave. I was surprised to see that DBTYPE="odbc" was working in this application as well, but it is. At this point, I'm just trying to determine if a DBTYPE="odbc" designation in CFMX would adversely affect performance for a JDBC datasource. ~

RE: cfmx cfquery dbtype="odbc"

2005-01-07 Thread Dave Watts
> The application I'm currently working on was originally > written in CF 4.5 so I'm frequently seeing dbtype="odbc" in > CFQUERY tags. Does anyone know if that setting could > adversely affect performance now that the DBTYPE attribute is > to be used to desi

cfmx cfquery dbtype="odbc"

2005-01-07 Thread Dina Hess
The application I'm currently working on was originally written in CF 4.5 so I'm frequently seeing dbtype="odbc" in CFQUERY tags. Does anyone know if that setting could adversely affect performance now that the DBTYPE attribute is to be used to designate a QofQ

Re: Using COMMIT inside cfquery with MySQL give error

2004-12-01 Thread Spectrum Web
Works now I insert this query after the first INSERT query COMMIT; Cheers >Hi all > >after insert a user record I need to show that same record to that >user. But using SELECT statement in other cfquery don't show that user >record. Please look this simple exa

Re: Using COMMIT inside cfquery with MySQL give error

2004-12-01 Thread Spectrum Web
Works now I insert this query after the first INSERT query COMMIT; Cheers >Hi all > >after insert a user record I need to show that same record to that >user. But using SELECT statement in other cfquery don't show that user >record. Please look this simple exa

Using COMMIT inside cfquery with MySQL give error

2004-12-01 Thread Marco Antonio C. Santos
Hi all after insert a user record I need to show that same record to that user. But using SELECT statement in other cfquery don't show that user record. Please look this simple example: INSERT INTO resourcebank ( userID,corpID,statusID,age1 ) VALUES ("8EFACE46-795D-1267-34CB31AA62

RE: The request has exceeded the allowable time limit Tag: CFQUERY

2004-11-12 Thread Micha Schopman
Try setting the default request timeout for that template higher by adding a cfsetting. Add this to the template in the top, to give the query 60 seconds time to execute before the process is aborted. Micha Schopman Software Engineer Modern Media, Databankweg 12 M, 3821 AL Amersfoort Tel 033

The request has exceeded the allowable time limit Tag: CFQUERY

2004-11-12 Thread Venkata Dharma Chand Bhaverisetti
I am getting this error on coldfusion mx when i am trying to execute a query. i would be happy if any body finds a solution to this with regards, chand ~| Special thanks to the CF Community Suite Gold Sponsor - CFHosting.net htt

Re: CREATE command in CFQUERY tag?

2004-10-07 Thread Janet Schmitt
code that creates a temporary table using a > > cfquery tag? > > > > Here's the code I'm trying to execute: > > > > CREATE TempTable AS > > > > (SELECT ENGINEER_SKILLS_ENGINEERS.ES_ENGINEERS_ID, > >  ENGINEER_SKILLS_SKILLSET.SKILLSET_ID,

Re: CREATE command in CFQUERY tag?

2004-10-07 Thread Michael Traher
-0400, Adrienne Brown <[EMAIL PROTECTED]> wrote: > Is it possible to execute code that creates a temporary table using a > cfquery tag? > > Here's the code I'm trying to execute: > > CREATE TempTable AS > > (SELECT ENGINEER_SKILLS_ENGINEERS.ES_ENGINEERS_ID

CREATE command in CFQUERY tag?

2004-10-06 Thread Adrienne Brown
Is it possible to execute code that creates a temporary table using a cfquery tag? Here's the code I'm trying to execute: CREATE TempTable AS (SELECT ENGINEER_SKILLS_ENGINEERS.ES_ENGINEERS_ID,  ENGINEER_SKILLS_SKILLSET.SKILLSET_ID,  ENGINEER_SKILLS_PROGRAMS.

<    3   4   5   6   7   8   9   10   11   12   >