如何在order by子句中防止coldfusion sql-injection

Question

由于cfqueryparam不按顺序工作,会使用xmlformat停止sql注入吗？

ORDER BY #xmlformat(myVariable)#

谢谢,

Answer 1

http://www.petefreitag.com/item/677.cfm

解决此限制的一种好方法是使用ListFindNoCase函数来限制可排序的列名,例如:

<cfset sortable_column_list = "age,height,weight,first_name">
<cfquery ...>
  SELECT first_name, age, height, weight
  FROM people
  ORDER BY <cfif ListFindNoCase(sortable_column_list, url.sort_column)>#url.sort_column#<cfelse>first_name</cfif>
</cfquery>