which one is a better practice ?

[FALCONSEYE]

which one is a better practice?

<cfquery ....>
insert into ...
values (<cfqueryparam value="..." cfsqltype="cf_sql_integer" >
</cfquery>

or

<cfquery ....>
insert into ...
values (#FORM.myId#)
</cfquery>

in other words, is it efficient to use <cfqueryparam> in an insert ? thanks for the help

 

[TruthInSatire]

Cfqueryparam offers better securiety and format validation.

We've heard that a million monkeys at a million keyboards could produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true.

 

[FALCONSEYE]

thank you sir..

 

[ecobb]

Yep, I use cfqueryparam on every query for that exact reason.


Hope This Helps!

ECAR
ECAR Technologies, LLC

http://www.ecartech.com

"My work is a game, a very serious game." - M.C. Escher

 

[AlanLL]

cfqueryparam or stored procedures