0

I am going to use the open source tool cflint but I would like to know what some of the warnings it lists actually mean or what they imply. The warnings in question are ones relating to security:

QUERYPARAM_REQ - SetSql() statement should use .addParam()

and

CFQUERYPARAM_REQ - cfquery should use < cfqueryparam>

Given these warnings, what problem do these indicate with the security of a program? I understand what fix they are suggesting, but what problem does this cause for security?

0

It sounds like it's asking you to use parameterized SQL queries to prevent SQL injection. Using parameterized SQL prevents first order SQL injection attacks by treating the input as a parameter, rather than just concatenating strings. For example, consider the following query :

"Select * from dbo.Users where Lastname='{value}';"

Assume a malicious user is attempting to input "' or 1=1; --". Using regular concatenation, this query becomes

Select * from dbo.Users where Lastname='' or 1=1; --;

and the application will return all rows from the users table. With parameterized SQL, the query will become

Select * from dbo.Users where Lastname=''' or 1=1; --';

and will only return rows where the last name matches "' or 1=1; --".

This stack overflow post may also have some useful information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.