阅读背景:

使用CFQUERYPARAM在SQL中指定表/列名称

来源:互联网 

I need to dynamically construct a set of JOIN statements where the table and column names are passed in from another ColdFusion query. When passing the string values to into the statement, CFQUERYPARAM adds single quotes around it - that's part of the point of CFQUERYPARAM. Given that this breaks the SQL statement, is it acceptable not to use CFQUERYPARAM in this case and instead ensure that the incoming query is cleansed, or is there a way round which allows CFQUERYPARAM to be used? (I can lock down these pieces of code using circuit/fuse permissions in Fusebox.)I need to dynamically construct a set of JOIN s




你的当前访问异常,请进行认证后继续阅读剩余内容。

分享到: