dynamic variable name and output problem

[megalith]

Hey all,
I having trouble with dynamically naming a variable and then outputting the
value. If I hard code the output blick below to #scoreAvg#, it outputs '0'.
If anyone could tell me how to get the below code to output '0' and not the
term 'scoreAvg' I would really appreciate it.

Thanks in advance,
Bart

<cfset i = "score">
<cfset '#i#Avg' = 0>
<cfoutput>#i#Avg</cfoutput>

[megalith]

As usual the answer was pretty simple, I just had to change the output to
<cfoutput>#evaluate('#i#Avg')#</cfoutput>

[Stressed_Simon]

You don't need to use evaluate() here.

Use
<cfset VARIABLES[i & "Avg"] = 0>

and

<cfoutput>#VARIABLES[i & "Avg"]#</cfoutput>

evaluate() is slower to process and has security issues!

[megalith]

Thanks Simon
I never new that existed and can't find it in my CFWACK book (although it is
probably somewhere).
Out of curiosity, and if you have time, what are the security issues with
Evaluate and other uses for Variables?

thanks for your reply,
Bart

[Stressed_Simon]

When you set a local variable ie <cfset myVar = "Simon"> you are really setting
VARIABLES.myVar = "Simon" the variables scope is the only scope that you can
usually get away with not specifying.

So this is actually a Stucture called VARIABLES. You can reference structure
keys in two ways using dot notiation (VARIABLES.myVar) or you can use Array
Notation (VARIABLES["myVar"]) these are identical. But as I mentioned before
the array notation is very handy for dynamically named vars.

Basically evalute() has security issues for example if you pass a FORM or URL
variable that is a CF function it will run it (BAD NEWS). So I never use it,
generally if you have to use Evaluate() you are doing something wrong.

HTH

[Unregistered]

Thank you, Stressed_Simon!

I was able to use the VARIABLES[varname] technique to pass a series of list loop index values into a SQL query. The variable must be first referenced in a string variable; it cannot be included directly in the cfquery SQL statement. I tried many ways without success until I read your post.

Hope this helps someone...

My example outputs employee directory information grouped by role. It loops through three roles in the role_list. Within each role, it loops through employee IDs from matching lists using the SQL IN operator. Note the employee IDs were necessarily in lists because they were a handpicked group not queryable by department, etc.

<cfset role_list = "Faculty,Staff,Student_Employees">
<cfset Faculty = "1529, 156, 1096, 1964, 1137, 23, 105">
<cfset Staff = "27, 2039">
<cfset Student_Employees = "2339, 2340, 2338">

<cfloop index="thisRole" list="#role_list#">

<div class="profiles">
<a name="<cfoutput>#thisRole#</cfoutput>"></a>
<h2><cfoutput>#replace(thisRole,"_"," ","ALL")#</cfoutput></h2>

<cfset sqlString = "
SELECT tblEmployee.*
FROM tblEmployee
WHERE tblEmployee.employee_ID IN (" & #VARIABLES[thisRole]# & ")
ORDER BY tblEmployee.last_name, tblEmployee.first_name
">

<cfquery name="getEmployeeDetails" datasource="directory">
#sqlString#
</cfquery>

...

</cfloop>

...