If it's a dynamic as opposed to a static value, it should be passed as a parameter.
I detail the whys & wherefors in this article, which might be useful to you: http://adamcameroncoldfusion.blogspot.co.uk/2012/07/what-one-can-and-c annot-do-with.html
Thinking about it, even with a static value I might consider parameterising it: it's a VALUE, not part of the SQL statement. I think people most often hard-code these too, though, because they don't change, so will not impact the query compilation process.
As for <cfinsert> and <cfupdate>. They certainly didn't USED to be parameterised. I think they are now, since CF9 though. I'm pretty sure if you have DB debugging displaying, the generated SQL from these tags is output, so you could check...
--
Adam
