Problem with SQL Security Settings

Question

I've run into an odd problem since moving to ColdFusion 8
Enterprise Edition. Any text string submitted to an action page
through a form will return an error ("Executing the SQL statement
is not allowed.") if it contains text that conforms to a disallowed
SQL command. For example, I've turned off the "create" as an
allowed SQL statement in my datasources. If I submit a form that
includes the following text, "Go back to the beginning of the
document; create a title," I get the error message. This occurs in
richtext form fields as well as in standard input form fields. If I
turn off the security setting so that "create" is an allowed SQL
command, the error goes away and (fortunately) no table is created.
It appears that ColdFusion is checking for the presence of
illegal commands even in text strings that are delimited by single
quotes in a query -- and even when those text strings wouldn't
actually do anything to a database.
Has anyone else run into this? Am I missing a setting on my
Administrator? Or am I missing something obvious? I'm not pleased
about the options I have at this point -- turning off some of my
security settings or allowing errors to occur and telling people
not to use semicolons as a workaround.
Thanks for any help you might offer.
Mike

Answer 1

Mike Palmquist wrote:
> Thanks for any help you might offer.
>
> Mike
>
Are you using <cfqueryparam...> tags? It sounds like
you are directly
passing the form text into the SQL statement. If this is what
you are
doing, then you are probably getting the expected, safest
results. If
you do not use the <cfqueryparam...> tag to tell
ColdFusion and your
database that this is a bound parameter then it is possible
that the
text is expected to contain SQL code and it will be parsed as
such.
To give clearer advice it would be helpful to see an example
of your code.