Comments on snippet: 'Inserting from a form into a database'

deepdown said on 17/Apr/2009

Fri, 17 Apr 2009 11:25:55 UTC

You should use cfqueryparam to avoid SQL injection. Furthermore if #form.msg# contains a single quote it breaks the code. The cfsqltype attribute in cfqueryparam is optional by the way :) ` INSERT INTO comment(poster, email, msg) VALUES (, , ) `

deepdown said on 17/Apr/2009

Fri, 17 Apr 2009 11:27:29 UTC

INSERT INTO comment(poster, email, msg) VALUES (, , )