这是cfscript中的ColdFusion Bug吗？

Question

这是一个有效的查询,用于返回users表中包含单引号的电子邮件.

SELECT  '''' +email + '''' as email
FROM    users
where fname = @fname

然而,当我尝试在cfscript(cf9)查询中执行此操作时,如下所示:

var q = new Query(datasource="warewithal");
q.setSQL("SELECT  '''' +email + '''' as email
                FROM users where firstName= :firstName ");
q.addParam(name="firstName", value=trim(firstName), cfsqltype="cf_sql_varchar");

我最终得到的是

Email
+email+

当我期望(并通过在分析器中运行查询获得)

Email
'bozo@clowns.com'

cfscript正在执行一个perserveSingleQuote并且不允许我将单引号添加到输出中.

这是一个错误还是我做错了什么？

Answer 1

要回答标题中的问题:不,这不是CFScript中的错误.您所演示的内容与CFScript完全没有任何关系.

但是要回答这个问题,你的意思是:是的,你在Query.cfc中发现了一个错误.

这里有一些代码可以演示这个bug(并证明它与CFScript无关,而且与Query.cfc有关).

这段代码工作正常:

<cfset query = new Query(datasource="scratch_mssql")>
<cfset query.setSql("
    SELECT  '''' + email + '''' as email
    FROM    users
    WHERE   firstName = '#firstName#'   
")>
<cfset emailAddresses = query.execute().getResult()> 
<cfdump var="#emailAddresses#">

请注意,我已将过滤器值硬编码到SQL字符串中.呸.

此代码错误:

<cfset query = new Query(datasource="scratch_mssql")>
<cfset query.setSql("
    SELECT  '''' + email + '''' as email
    FROM    users
    WHERE   firstName = :firstname  
")>
<cfset query.addParam(name="firstname", value=firstName, cfsqltype="CF_SQL_VARCHAR")>
<cfset emailAddresses = query.execute().getResult()> 
<cfdump var="#emailAddresses#">

我的错误是:

[Macromedia][SQLServer JDBC Driver][SQLServer]An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Change the alias to a valid name.

仅供参考:CF传递给DB的SQL是:

SELECT  '' '' + email + '' '' as email FROM users WHERE firstName = (param 1)

为了证明它是由ColdFusion错误处理您的单引号引起的,这可行:

<cfset query = new Query(datasource="scratch_mssql")>
<cfset query.setSql("
    SELECT  email as email
    FROM    users
    WHERE   firstName = :firstname  
")>
<cfset query.addParam(name="firstname", value=firstName, cfsqltype="CF_SQL_VARCHAR")>
<cfset emailAddresses = query.execute().getResult()> 
<cfdump var="#emailAddresses#">

如果我是你,我会为此提出一个错误.注意:在CF9.0.2和CF10.0.7上也是如此

但是,同样......如果我是你,我无论如何都不会把那些引号放在那里.除非有一个很好的理由,否则当你进行显示时,不要在进行数据处理时将它们粘在上面.我认为他们是出于展示目的？