Seek out unparamaterized queries in ColdFusion templates and, at user's option, parameterize them.
Daryl Banttari dbanttari@gmail.com
http://www.webapper.com/blog/index.php/2008/07/22/coldfusion-sql-injection
This will probably break some queries, especially if you do things like WHERE date > ‘#dateFormat(d)# #timeformat(d)#’ or WHERE NAME LIKE ‘#searchname#%’. USE WITH CAUTION! It’s best to test the changes before moving them into production. Remove the “.old” files once the site is confirmed as working well.
RELEASED TO THE PUBLIC DOMAIN. But feel free to credit Daryl Banttari with original authorship if you release it with modifications.
This project uses the excellent Git Workflow series by Bob Silverburg for contributions.
Before contributing, please read this [http://help.github.com/dealing-with-lineendings/](http://help.github.com/dealing-with-lineendings/)