Try it.  If you are using MS SQL or Sybase, you can putting mulitple queries into a cfquery tag.

Here is your test.  In a numeric field, put "2; update yourtable set somefield = something_else" and submit the form to something with a cfinsert or cfupdate.  See what happens.

There is an issue raised in the CF bugbase - http://cfbugs.adobe.com/cfbugreport/flexbugui/cfbugtracker/main.html#b ugId=78833.

This implies:

* yes it's a problem (the issue is open, not closed);

* no it's not fixed.

--

Adam

I do agree with you here.  But to be devil's advocate for a second: the same could be said of <cfquery>.  One has to take additional measures to ensure the same vulnerabilities are mitigated with that.

I'm not sure that it's really news that these two tags are not the most well-thought-out features in the CF arsenal, and if you listen to most opinions in the community regarding <cfinsert> and <cfupdate>, it's: "don't use them".

They're great for quick and dirty insert/update processes in internal or test code, but I'd never use them in production.

It also remains a fact that any external input (form fields, URL param) must be validated as being kosher and within expected margins before they're used in any way.  That is just common sense.  And if one neglects to do that: one brings any eventuality onto one's self.  The problem here really is with people not doing their "due diligence" on externally sourced data, not specififcally with <cfinsert>, <cfupdate> or <cfquery>.

Still: I think Adobe should make it more clear in the docs that additional measures need to be take to make them safe.  And by that time... one might as well use a <cfquery> to do the SQL.

--

Adam

Just an update on this old, tired-out thread.

I just tested <CFUPDATE> and <CFINSERT> on CF9.0.2 and CF10, and the SQL being sent to the DB is indeed parameterised.

--

Adam