> is it possible to break out of a sql "IN" clause to perform a sql injection attack, with
> something other than a select statement as the parameter?
Yes, unless you use cfqueryparam as Jones911 mentioned. To add a bit more detail, this protection is a side effect of cfqueryparam's usage of bind variables. The values are separated and transparently handled as the values of the proper type (varchar, int, datetime, etc...), which prevents the execution of a typical sql injection string.
There is however, one exception. If your application uses dynamical sql execution, you may still be vulnerable. Cfqueryparam does not prevent the malicious string from being stored in your database. So if you later retrieve that value and execute it as part of a dynamic sql string, obviously bad things will happen. So you may want to implement multiple layers, such as checking requests for potential sql injection attacks in user supplied values like #url#, #form#, etc.... You can do this in your Application.cfc file using one of the onRequest... methods. If an attack is detected, just cancel the request. Though the biggest down-side of that approach is false positives.
I would also recommend you do a search on ColdFusion sql injection. There are a number of good articles and recommendations on the different types of attacks. Especially after a recent rise in CF specific attacks:
http://www.coldfusionmuse.
http://russ.michaels.me.uk
Main Topics
Browse All Topics
by: Jones911Posted on 2009-01-12 at 08:43:24ID: 23354787
User <cfqueryparam /> it will solve your worries: http://livedocs.adobe.com/