Hi,
I was researching ways to prevent SQL Injection.
I found where to use cfqueryparm. See below.
<cfquery ...>
SELECT *
FROM Customers
WHERE CustID=<cfqueryparam value="#URL.CustID#"
cfsqltype="CF_SQL_INTEGER">
</cfquery>
I can see the above if there is only value in the Where statement
condition.
But I have a Where statement where there is multiple conditions in the
IN condition.
For example:
Where fieldname IN (#value1#, #value2#, etc..)
How can the cfqueryparm be used?
Thanks in Advance.
