SQL Injection Cheat Sheet

A Database Independent "Next ID"

Webapper has good review of how to manage next ID functionality.

Data Generator

Data Generator is a simple web-based tool that lets you create large volumes of random, custom data for use in testing software. You can have your data formatted in HTML tables, CSV or SQL statements. They also offer a free desktop application that will generate larger sets of data. Check it out next time your in need of sample data.

MySQL Advice

SQL Injection Attacks by Example

If you have developed a web application with a database back-end, you should check out this article titled SQL Injection Attacks by Example. It clearly explains what a SQL injection attack is and shows you how defend against such attacks.

MySQL on Mac

OReillys MacDevCenter has an article that will help you with Managing MySQL on Mac OS X. Their coverage includeds installing mySQL then getting a GUI based tool to manage your databases.

ColdFusion and Pagination

Some good discussion going on here.

As usual Ray Camden is leading the way and others, Rob Gonda and WaterSwing have followed.

Write a Good Query

Ray has sparked some good comments on getting your SQL query to run quick. It's all down to the index!

Here's the posting.

Record Paging in MS SQL Server

MySQL has always had a great clause in the SELECT function called LIMIT which allows you to get to a subset of records in the db. MS SQL Server doesn't have that.

I found this blog entry which also directed me to this MS TechNote which seems to offer a soluction.

Here's the code:

SELECT TOP <pageSize> CustomerID,CompanyName,ContactName,ContactTitle
FROM
(SELECT TOP <currentPageNumber * pageSize>
CustomerID,CompanyName,ContactName,ContactTitle
FROM
Customers AS T1 ORDER BY ContactName ASC)
AS T2 ORDER BY ContactName DESC

CFQUERYPARAM Types

ColdFusion JDBC DB2 Informix Oracle MS Access MSSQL

CF_SQL_ARRAY

ARRAY

 

 

 

 

 

CF_SQL_BIGINT

BIGINT

Bigint

int8, serial8

 

Yes/No

 

CF_SQL_BINARY

BINARY

Char for Bit Data

 

 

 

binary

timestamp

CF_SQL_BIT

BIT

 

boolean

 

 

bit

CF_SQL_BLOB

BLOB

Blob

blob

blob, bfile

 

 

CF_SQL_CHAR

CHAR

Char

char,

nchar

char,

nchar

 

char, nchar,

unique
identifier

CF_SQL_CLOB

CLOB

Clob

clob

clob,nclob

 

 

CF_SQL_DATE

DATE

Date

date, datetime, year to day

 

 

 

CF_SQL_DECIMAL

DECIMAL

Decimal

decimal, money

number

 

decimal, money, small
money

CF_SQL_DISTINCT

DISTINCT

 

 

 

 

 

CF_SQL_DOUBLE

DOUBLE

Double

 

 

 

 

CF_SQL_FLOAT

FLOAT

Float

float

number

 

float

CF_SQL_IDSTAMP

CHAR

Char

char, nchar

char, nchar

 

char, nchar, unique
identifier

CF_SQL_INTEGER

INTEGER

Integer

integer, serial

 

AutoNumber

int

CF_SQL_LONGVARBINARY

LONGVARBINARY

Long Varchar for Bit Data

byte

long raw

 

image

CF_SQL_LONGVARCHAR

LONGVARCHAR

Long Varchar

text

long

Memo

text, ntext

CF_SQL_MONEY

DOUBLE

Double

 

 

Currency

 

CF_SQL_MONEY4

DOUBLE

Double

 

 

 

 

CF_SQL_NULL

NULL

 

 

 

 

 

CF_SQL_NUMERIC

NUMERIC

Numeric

 

 

Number

numeric

CF_SQL_OTHER

OTHER

 

 

 

 

 

CF_SQL_REAL

REAL

Real

smallfloat

 

 

real

CF_SQL_REFCURSOR

REF

 

 

 

 

 

CF_SQL_SMALLINT

SMALLINT

Smallint

smallint

 

 

smallint

CF_SQL_STRUCT

STRUCT

 

 

 

 

 

CF_SQL_TIME

TIME

Time

datetime hour to second

 

 

 

CF_SQL_TIMESTAMP

TIMESTAMP

Timestamp

datetime year to fraction(5), datetime year to second

date

Date/Time

datetime, smalldate
time

CF_SQL_TINYINT

TINYINT

 

 

 

 

tinyint

CF_SQL_VARBINARY

VARBINARY

Rowid

 

raw

 

varbinary

CF_SQL_VARCHAR

VARCHAR

Varchar

varchar, nvarchar, lvarchar

varchar2, nvarchar2

Text

varchar, nvarchar, sysname

More Entries

BlogCFC was created by Raymond Camden. This blog is running version 5.9.001. Contact Blog Owner