cf with mysql, escaping chars

[tlyost]

Hi all,
I am converting a rather larger parsing program from php to coldfusion. So
far so good, until I found where it inserts data into the database, the php
code calls mysqli_real_escape_string on the data first. Research reveals that
this php function "escapes" NUL, \n, \r, \, ', and ". Further reading
suggests that mysql requires these chars to be escaped.

Anyone know of an easy way to accomplish this in cf ?

[cf_menace]

You'll probably want to use <cfqueryparam> on all your SQL statements in order
to properly handle datatypes and to keep your queries safe from SQL Injections.
The tag also handles escaping characters when needed.

Check
[url]http://livedocs.macromedia.com/coldfusion/7/htmldocs/wwhelp/wwhimpl/common/html/[/url]
wwhelp.htm?context=ColdFusion_Documentation&file=0 0000317.htm for more info.



INSERT INTO someTable
(
someColumn
)
VALUES
(
<cfqueryparam value="#someVariable#" cfsqltype="CF_SQL_VARCHAR"
maxlength="255" />
)