RE: cfinsert/cfupdate

2010-09-25 Thread Leigh
I think you are referring to SCOPE_IDENTITY() No, I did mean @@IDENTITY. Though I am going off of much older threads where it was used within a cftransaction, and separate cfquery, to retrieve the Autonumber value from an Access table. Rick's post contained the basic concept, but with

Re: cfinsert/cfupdate

2010-09-25 Thread Dave Watts
Ok, so I found out I WAS correct.  Either that or yet another article I found on prepared statements is wrong.  Here's a quote from the article: The PreparedStatement object contains not just an SQL statement, but an SQL statement that has been precompiled. This means that when the

Re: cfinsert/cfupdate

2010-09-24 Thread Aaron Neff
Hi Leigh, Good points you make here. Not sure why cfinsert|update don't accept a result attribute and return a result struct. I'll probably have to re-file, since I don't see ER #71025 (filed in 2007) in the tracker anymore. Thanks, -Aaron Neff 1) Retrieve an identity/autoincrement value

Re: cfinsert/cfupdate

2010-09-24 Thread Sean Corfield
On Thu, Sep 23, 2010 at 12:10 PM, Jacob Munson yacoub...@gmail.com wrote: While I won't tell ORM fans that they shouldn't use ORM, I have done my fair share of railing against ORM. As you have against OO and various other modern ways of thinking about software - and as Rick points out you are

Re: cfinsert/cfupdate

2010-09-24 Thread Dave Watts
I don't know the deep technical details, but I do know that many people argue that using query params actually gives you a performance benefit over plain SQL (although a lot of people disagree). This isn't really a matter for debate. In some cases, parameterized SQL is faster. In other cases,

RE: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
this on Microsofts SQL server MSDN and technet pages. Russ -Original Message- From: Dave Watts [mailto:dwa...@figleaf.com] Sent: 24 September 2010 15:09 To: cf-talk Subject: Re: cfinsert/cfupdate I don't know the deep technical details, but I do know that many people argue that using

Re: cfinsert/cfupdate

2010-09-24 Thread Rick Root
Just for fun, here's some examples of what SQL Server receives from coldfusion when you run a pretty simple query using cfqueryparam: declare @p1 int set @p1=748592 exec sp_prepexec @p1 output,N'@P1 int,@P2 bit',N'select gallery_link_id, gallery_link_name from gallery_links where

Re: cfinsert/cfupdate

2010-09-24 Thread Leigh
Hi Aaron, Sounds good. It would certainly come in handy. Especially the ability to retrieve identity/autoincrement values. -Leigh ~| Order the Adobe Coldfusion Anthology now!

Re: cfinsert/cfupdate

2010-09-24 Thread Rick Root
On Fri, Sep 24, 2010 at 10:55 AM, Leigh cfsearch...@yahoo.com wrote: Sounds good. It would certainly come in handy.  Especially the ability to retrieve identity/autoincrement values. Can you do that by running it inside cftransaction? cftransaction cfinsert cfqueryselect @@identity ...

RE: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
Message- From: Rick Root [mailto:rick.r...@gmail.com] Sent: 24 September 2010 16:01 To: cf-talk Subject: Re: cfinsert/cfupdate On Fri, Sep 24, 2010 at 10:55 AM, Leigh cfsearch...@yahoo.com wrote: Sounds good. It would certainly come in handy.  Especially the ability to retrieve identity

RE: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
: http://russ.michaels.me.uk/ skype: russmichaels MSM: r...@michaels.me.uk Russ -Original Message- From: Rick Root [mailto:rick.r...@gmail.com] Sent: 24 September 2010 15:29 To: cf-talk Subject: Re: cfinsert/cfupdate Just for fun, here's some examples of what SQL Server receives from

Re: cfinsert/cfupdate

2010-09-24 Thread Rick Root
On Fri, Sep 24, 2010 at 11:13 AM, Russ Michaels r...@michaels.me.uk wrote: This is covered in the CF docs actually, so if your not sure you can RTFM. We're having a discussion on the possibilities. Someone else can RTFM if they're interested in actually trying what I'm suggesting. =)

RE: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
www.cfmldeveloper.com FREE CFML developer hosting -Original Message- From: Rick Root [mailto:rick.r...@gmail.com] Sent: 24 September 2010 16:34 To: cf-talk Subject: Re: cfinsert/cfupdate On Fri, Sep 24, 2010 at 11:13 AM, Russ Michaels r...@michaels.me.uk wrote: This is covered in the CF docs actually

RE: cfinsert/cfupdate

2010-09-24 Thread Roger Austin
Russ Michaels r...@michaels.me.uk wrote: snip It is also easier from a self containment and portability point of view to keep SQL within the application. Stored Procs written for MSSQL clearly wont run on MySQL. I hear this sometime and wonder how many times you have to port something

Re: cfinsert/cfupdate

2010-09-24 Thread Leigh
Can you do that by running it inside cftransaction? I remember seeing something similar in old threads about retrieving an Autonumber value for an Access database. I have not really thought it through, but I suppose in theory it might work. Though it does seem like stretching the intent of

RE: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
17:38 To: cf-talk Subject: Re: cfinsert/cfupdate Can you do that by running it inside cftransaction? I remember seeing something similar in old threads about retrieving an Autonumber value for an Access database. I have not really thought it through, but I suppose in theory it might work

Re: cfinsert/cfupdate

2010-09-24 Thread Gerald Guido
Michaels my blog: http://russ.michaels.me.uk/ www.cfmldeveloper.com - free CFML hosting for developers skype: russmichaels -Original Message- From: Leigh [mailto:cfsearch...@yahoo.com] Sent: 24 September 2010 17:38 To: cf-talk Subject: Re: cfinsert/cfupdate Can you do

RE: cfinsert/cfupdate

2010-09-24 Thread Leigh
There is a built in method of getting that last records primarykey for most databases, but not for MSACCESS. I cannot speak for its reliability, but I believe MS Access does have @@identity. However as shown in one of the previous posts, retrieving the value is a bit more convoluted than in

Re: cfinsert/cfupdate

2010-09-24 Thread Rick Root
On Fri, Sep 24, 2010 at 11:51 AM, Russ Michaels r...@michaels.me.uk wrote: After all, you can only really discuss the possibilities if you actually know what is and is not possible, otherwise it's the blind leading the blind isn't it ? /usefulConversation

RE: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
www.cfmldeveloper.com - free CFML hosting for developers my blog: http://russ.michaels.me.uk/ skype: russmichaels -Original Message- From: Leigh [mailto:cfsearch...@yahoo.com] Sent: 24 September 2010 18:16 To: cf-talk Subject: RE: cfinsert/cfupdate There is a built in method of getting

Re: cfinsert/cfupdate

2010-09-24 Thread Jacob Munson
Wow, calm down there partner! I clearly stated in my post that I could be wrong about this, and I invited people to correct me if I am wrong. As far as Dave is of course correct as usual. Dave has been known to be wrong before. Feel free to dismantle your Dave Watts shrine. ;) I KNOW for a

Re: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
wow, toys back in the pram dude. Don't take things so personally, you just got corrected is all. :-) On Fri, Sep 24, 2010 at 8:06 PM, Jacob Munson yacoub...@gmail.com wrote: Wow, calm down there partner! I clearly stated in my post that I could be wrong about this, and I invited people to

Re: cfinsert/cfupdate

2010-09-24 Thread Michael Grant
Meh. I'm keeping my Dave Watts shrine right where it is. He's a smart guy that seems to have an answer to everything. (Well except my question about cfinvoke and webservices.) /me walks away grumbling. On Fri, Sep 24, 2010 at 3:06 PM, Jacob Munson yacoub...@gmail.com wrote: Wow, calm down

Re: cfinsert/cfupdate

2010-09-24 Thread Russ Michaels
And plenty or sarcastic ones at that :-) It's because Dave doesn't actually do any work, he clearly spends all day on discussion lists LOL On Sat, Sep 25, 2010 at 12:52 AM, Michael Grant mgr...@modus.bz wrote: Meh. I'm keeping my Dave Watts shrine right where it is. He's a smart guy that

Re: cfinsert/cfupdate

2010-09-24 Thread Jacob Munson
This isn't really correct. The query isn't compiled in any case. Ok, so I found out I WAS correct. Either that or yet another article I found on prepared statements is wrong. Here's a quote from the article: The PreparedStatement object contains not just an SQL statement, but an SQL

cfinsert/cfupdate

2010-09-23 Thread Rick Root
I've been trying to convince one of my friends that using cfinsert and cfupdate is a bad idea. I recently told him that real CF programmers don't use cfinsert and cfupdate :) He responded with this: CF8 uses cfqueryparam inside all cfinsert/cfupdate statements, making it just as safe

Re: cfinsert/cfupdate

2010-09-23 Thread Michael Grant
with this: CF8 uses cfqueryparam inside all cfinsert/cfupdate statements, making it just as safe as a regular cfquery, but minus all the clunky code needed to create the query. Actually, scratch that, both queries, since without them you have to maintain both the insert and update statements

re: cfinsert/cfupdate

2010-09-23 Thread Jason Fisher
in cftransaction or whatever. But, that being said, it seems like cfinsert / cfupdate have gotten better since the bad old days where they were truly scary. I don't use the tags personally and I don't plan to, but your friend's arguments seem sound. - Jason Smokey the Bear’s rules for fire safety

RE: cfinsert/cfupdate

2010-09-23 Thread Russ Michaels
...@michaels.me.uk -Original Message- From: Rick Root [mailto:rick.r...@gmail.com] Sent: 23 September 2010 16:09 To: cf-talk Subject: cfinsert/cfupdate I've been trying to convince one of my friends that using cfinsert and cfupdate is a bad idea. I recently told him that real CF

Re: cfinsert/cfupdate

2010-09-23 Thread Rick Root
It seems to me that using cfinsert and cfupdate is a security risk. I mean, what if I wrote a script to post the form with additional form fields? I mean, people don't always know your db structure but they can guess at things sometimes.

Re: cfinsert/cfupdate

2010-09-23 Thread Rick Root
On Thu, Sep 23, 2010 at 11:19 AM, Russ Michaels r...@michaels.me.uk wrote: So I'd say he is right in the broadest sense, and these tags are especially good for newbies and developers who just learn a small set of CFML tags or Sadly, he's a 10 year veteran CF programmer.

RE: cfinsert/cfupdate

2010-09-23 Thread Russ Michaels
anything that shouldn't be there or simply do not execute the SQL code if you think the request did not come form the original form. Russ -Original Message- From: Rick Root [mailto:rick.r...@gmail.com] Sent: 23 September 2010 16:21 To: cf-talk Subject: Re: cfinsert/cfupdate It seems to me

Re: cfinsert/cfupdate

2010-09-23 Thread Rick Root
How does Coldfusion manufacturer the queryparams? It must inspect the database to determine field types... I wonder if that's a performance hit... I just hate not knowing what the hell its doing. ~| Order the Adobe Coldfusion

RE: cfinsert/cfupdate

2010-09-23 Thread Russ Michaels
: cfinsert/cfupdate On Thu, Sep 23, 2010 at 11:19 AM, Russ Michaels r...@michaels.me.uk wrote: So I'd say he is right in the broadest sense, and these tags are especially good for newbies and developers who just learn a small set of CFML tags or Sadly, he's a 10 year veteran CF programmer

RE: cfinsert/cfupdate

2010-09-23 Thread Justin Scott
railing against using that technology. Personally it's been many years since I last looked at cfinsert/cfupdate, but if the queries that they generate are 'safe' then it might be worth taking another look at as an option to use where appropriate. -Justin

RE: cfinsert/cfupdate

2010-09-23 Thread Russ Michaels
any significant performance issues. Russ -Original Message- From: Rick Root [mailto:rick.r...@gmail.com] Sent: 23 September 2010 16:25 To: cf-talk Subject: Re: cfinsert/cfupdate How does Coldfusion manufacturer the queryparams? It must inspect the database to determine field types

Re: cfinsert/cfupdate

2010-09-23 Thread Rick Root
On Thu, Sep 23, 2010 at 11:24 AM, Russ Michaels r...@michaels.me.uk wrote: That applies across the board Rick, to any sql in any code on any site. If No, it certainly doesn't. If you write the SQL, they can't post additional form fields that you're not expecting and have them get into your

RE: cfinsert/cfupdate

2010-09-23 Thread Russ Michaels
: cfinsert/cfupdate For me I like to be able to have as much control over my query statements as possible. It makes it easier to read/ understand and to see EXACTLY what is being sent to the db. While I generally agree with that sentiment, ORM does the same thing on a more grand scale, and I

RE: cfinsert/cfupdate

2010-09-23 Thread Russ Michaels
-talk Subject: Re: cfinsert/cfupdate On Thu, Sep 23, 2010 at 11:24 AM, Russ Michaels r...@michaels.me.uk wrote: That applies across the board Rick, to any sql in any code on any site. If No, it certainly doesn't. If you write the SQL, they can't post additional form fields that you're

RE: cfinsert/cfupdate

2010-09-23 Thread Jason Fisher
Actually, I don't use ORM for much the same reason I don't use cfinsert / cfupdate. I still like to craft my SQL and I often have complex relationships that are easy to write in SQL and a PITA to model in an ORM. - Jason Smokey the Bear’s rules for fire safety also apply to government: Keep

Re: cfinsert/cfupdate

2010-09-23 Thread Michael Grant
the same reason I don't use cfinsert / cfupdate. I still like to craft my SQL and I often have complex relationships that are easy to write in SQL and a PITA to model in an ORM. - Jason Smokey the Bear’s rules for fire safety also apply to government: Keep it small, keep it in a confined area

Re: cfinsert/cfupdate

2010-09-23 Thread Dave Watts
No, it certainly doesn't.  If you write the SQL, they can't post additional form fields that you're not expecting and have them get into your SQL statement. If I recall correctly, you can limit the form fields used by CFINSERT/CFUPDATE using the FORMFIELDS attribute. So that's not a big deal

RE: cfinsert/cfupdate

2010-09-23 Thread Leigh
an identity/autoincrement value from an INSERT 2) Return the number of records affected by an UPDATE 3) (Also, from a recent question on the adobe forums..) Do you need to handle/escape invalid column names? My guess would be these features are not supported with cfinsert/cfupdate. But I do not know

Re: cfinsert/cfupdate

2010-09-23 Thread Jacob Munson
How does Coldfusion manufacturer the queryparams? It must inspect the database to determine field types... I wonder if that's a performance hit... I don't know the deep technical details, but I do know that many people argue that using query params actually gives you a performance benefit

Re: cfinsert/cfupdate

2010-09-23 Thread denstar
On Thu, Sep 23, 2010 at 9:50 AM, Michael Grant wrote: +1 I feel exactly the same way and still write my SQL statements myself. IMO it's necessary when you start getting into multiple advanced joins, computed columns and inline equations. This is actually where ORM shines. You can do

Re: cfinsert/cfupdate

2010-09-23 Thread Jacob Munson
While I generally agree with that sentiment, ORM does the same thing on a more grand scale, and I haven't seen anyone railing against using that technology. While I won't tell ORM fans that they shouldn't use ORM, I have done my fair share of railing against ORM. As others have said in

RE: cfinsert/cfupdate

2010-09-23 Thread Justin Scott
Some good points were made, on both sides. I am almost thinking about switching sides ... not. The thing is that it's not really about sides it's about using the right tools at the right times. If you have a basic update/insert query that doesn't have any special needs, I suppose using those

RE: cfinsert/cfupdate

2010-09-23 Thread Leigh
The thing is that it's not really about sides it's about using the right tools at the right times.  The remark about sides was intended as sarcasm ;) ie Conversations about cfinsert/cfupdate tend to lean towards the passionate side. I was totally serious when I said some good points were

Re: cfinsert/cfupdate

2010-09-23 Thread Rick Root
On Thu, Sep 23, 2010 at 3:02 PM, Jacob Munson yacoub...@gmail.com wrote: That said, this does not work if you don't use cfqueryparams for everything.  For example, this query would NOT be a prepared statement (from what I understand): cfquery name=bday datasource=#myDSN#    select

GoDaddy, Access DBs, and cfinsert/cfupdate

2009-06-26 Thread Les Irvin
I'm porting a website for a client over to GoDaddy from another server. Using cfinsert/cfupdate tags to manipulate Access databases. When trying to insert/edit more than a few sentences of data into a memo field, it causes an error on the GoDaddy server: Error Executing Database Query

Re: GoDaddy, Access DBs, and cfinsert/cfupdate

2009-06-26 Thread Dave Watts
I'm porting a website for a client over to GoDaddy from another server.  Using cfinsert/cfupdate tags to manipulate Access databases. When trying to insert/edit more than a few sentences of data into a memo field, it causes an error on the GoDaddy server: Error Executing Database Query

CFINSERT, CFUPDATE, Ben Forta, SQL injection and more...

2007-09-20 Thread Les Mizzell
I've inherited a large site chock full of cfupdate/cfinsert. Rewriting all of them is probably outside the scope of the budget given me for other updates, but now I'm curious... Ben Forta says: And what's more, CFINSERT and CFUPDATE actually help avoid common pitfalls and problems. Do

cfinsert/cfupdate and double quotes

2007-02-26 Thread Les Mizzell
inserts instead of cfinsert/cfupdate? ~| ColdFusion MX7 and Flex 2 Build sales marketing dashboard RIA’s for your business. Upgrade now http://www.adobe.com/products/coldfusion/flex2 Archive: http://www.houseoffusion.com/groups/CF

Re: cfinsert/cfupdate and double quotes

2007-02-26 Thread Steve Bryant
SQL inserts instead of cfinsert/cfupdate? ~| Macromedia ColdFusion MX7 Upgrade to MX7 experience time-saving features, more productivity. http://www.adobe.com/products/coldfusion Archive: http://www.houseoffusion.com/groups/CF

Re: cfinsert/cfupdate and double quotes

2007-02-26 Thread Les Mizzell
Steve Bryant wrote: Are you sure that the problem isn't that you are using input type=text instead of textarea? After looking at it a little closer - my bad. The value Bob Bubba Jones *is* getting recorded correctly on insert/update. input id=ID_app_owner name=ID_app_owner

Re: cfinsert/cfupdate and double quotes

2007-02-26 Thread Steve Bryant
It's just not *displaying* when looking at the above. So value=#htmleditformat(getapp.ID_app_owner)# Or is there a better way? That is what I do. This also helps with security. ~| Upgrade to Adobe ColdFusion MX7

cfinsert cfupdate and Oracle 10g

2006-11-02 Thread Shelley Browning
I'm migrating a CF 4/Oracle 8 application that uses cfinsert and cfupdate tags to CFMX 7.0.2 and Oracle 10g. The tags are erroring on the table name property. The way this database access is set up I must prefix the table name with the schema name in order to access the data. When I use

RE: cfinsert cfupdate and Oracle 10g - bugs

2006-11-02 Thread Shelley Browning
Change subject line to see if someone might respond. Shelley -Original Message- From: Shelley Browning [mailto:[EMAIL PROTECTED] Sent: Thursday, November 02, 2006 11:08 AM To: CF-Talk Subject: cfinsert cfupdate and Oracle 10g I'm migrating a CF 4/Oracle 8 application that uses