Coldfusion Creating Random SQL Queries

Question

Here is an error I received from one of our sites:
Syntax error or access violation: You have an error in your
SQL syntax; check the manual that corresponds to your MySQL server
version for the right syntax to use near 'WHERE user_id = '19152'
AND paid = 0' at line 1
Here is the generated sql it tried to run:
SELECT SUM(hours) AS totalHours FROM records WHERE user_id =
'19152' WHERE user_id = '19152' AND paid = 0
Obviously there is two where statements.
Now look at the method that generated this:
<cffunction name="GetTotalUnpaidHours" access="public"
returntype="numeric" output="false">
<!--- Get total sum of unpaid hours
--------------------------------------------------->
<cfscript>
sql = "SELECT SUM(hours) AS totalHours ";
sql = sql & "FROM records ";
sql = sql & "WHERE user_id = '#variables.user_id#' ";
sql = sql & "AND paid = 0";
hours = SqlQuery(sql);
if ( IsNumeric(hours.totalHours) ) return hours.totalHours;
else return 0;
</cfscript>
</cffunction>
This is about as simple as it gets. Build an SQL string, pass
it to the SqlQuery() method with just globally available wrapper of
the CFQUERY tag, and return the result.
How and why would it append the WHERE statement twice. This
is not the first error like this from our high traffic production
site. 99% of the time it works as this method is called 1000's of
times a day by 1000's of users going in and out of their account
every all day. It is not limited to just this example as I've seen
similar instances of this happening with incorrect queries all over
the app. Tested and retested the code and have never been able to
reproduce these types of results.
Any comments or suggestions would be greatly appreciated.
It's essential that this application be 100% reliable.
Anthony

Answer 1

WebPexDev,
Interesting. Dan Bracuk could be right about it being a scope
problem. If the sql variable isn't local to the function I can
kindof see how you might end up with two where clauses in the sql
string.
> Build an SQL string, pass it to the SqlQuery() method
with just globally available
> wrapper of the CFQUERY tag, and return the result.
Assuming the functions are contained in a cfc, is the cfc
stored in the session or application scope?