Using a string variable as a query SQL statement

Question

I want to construct a custom SQL statement in a string var, then use that var in the cfquery statement.  What is the proper syntax?  Here is my feeble attempt:
  <cffunction ...>
  <cfset var sql_txt="">
        <cfquery name="qSBJs" datasource="cfBAA_odbc">
            "#sql_txt#"
        </cfquery>
    <cfreturn qSBJs>
I've tried using no " or # or just # or just " but nothing works.
what about:
        <cfquery name="qSBJs" datasource="cfBAA_odbc" sql="#sql_txt#">
        </cfquery>
nope.  I wish there was a sql property I could fill *before* the execution of the query.  Any suggestions?

Answer 1

Hi Adam, and/or anyone who may have a few minutes to check this... I got the following code to work.  It calls the getSBJs function from Flash Builder 4.  I get the correct result set back.  Long table names are replaced with short abreviations.  Note that some local vars are declared but not used in the following example. I will use them in the future versions of this same code.  Since I will in the future, like a donkey, mindlessly use this same method for all my queries, it would be much appreciated if I could get a guru to check this code for:
-Pure idiocy
-Mild insanity
-SQL injection vulnerability
-Memory leakage
-Scope dangers
(ignore emoticons, see the underlying text)
    <cffunction name="AbrvTblNms" output="false" returntype="string" >
        <cfargument name="txt" type="string" required="true" />
        <cfset var qAbrvs="">
        <cfset var output_str="#ARGUMENTS.txt#">
        <cfquery name="qAbrvs" datasource="cfBAA_odbc" result="rsltAbrvs">
            SELECT TBL_NM, ABRV FROM BAA_TBL_ABRV ORDER BY 1
        </cfquery>
    <cfloop query="qAbrvs">
            <cfset output_str = Replace(output_str, '[' & qAbrvs.TBL_NM & ']', qAbrvs.ABRV, "ALL")>
    </cfloop>
        <cfreturn output_str>
    </cffunction>
    <!--- Fetch a list photo subjects whose records contain the given search word(s) --->
    <cffunction name="getSBJs" output="false" access="remote" returntype="any" >
        <cfargument name="srch_val" type="string" required="true" />
        <cfset var qSBJs="">
        <cfset var sql_txt="">
        <cfset var whr=""> 
        <cfset var b=False>
        <cfset var in_txt="">
        <cfset var fm_dt="">
        <cfset var to_dt="">
        <cfset var on_dt="">
        <cfset var pht="">
        <cfset var srch_str="">
        <cfset var srch_trm="">
        <!--- Transfer the srch_val to a local variable for further manipulation --->
        <cfset srch_str = "#ARGUMENTS.srch_val#">
        <!---
            An empty search term argument is handled by the BAA FlashBuilder front end.  We test for it again here,
            and substitute a dummy value, in case this function is called by something other than the intended
            FlashBuilder front end, and that front end doesn't protect us from an empty search term argument.
            Remember that we must still "hand back" a valid query structure to avoid causing a data type error
            in the calling function, so we search for a dummy value that will allow the query to proceed but is
            guaranteed to return an empty result set.  If the srch_val argument is not empty, transfer the value of
            the srch_str local variable to the srch_trm local variable.
        --->
        <cfif Not (Len(srch_str))>
            <cfset srch_str = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX">
        </cfif>
        <cfset srch_trm = "#srch_str#">
        <cfset sql_txt =
            "SELECT DISTINCT
              [BAA_SBJ].SRC_SYS_NM, [BAA_SBJ].SRC_SYS_GUID, [BAA_SBJ].OBJ_GUID, [BAA_SBJ].SBJ_NM, [BAA_SBJ].SBJ_DOB, [BAA_SBJ].SBJ_ID, [BAA_SBJ].NOTE, [BAA_SBJ].CDT, [BAA_SBJ].CTM, [BAA_SBJ].CBY, [BAA_SBJ].MDT, [BAA_SBJ].MTM, [BAA_SBJ].MBY
            FROM
              BAA_SBJ [BAA_SBJ]
              LEFT JOIN BAA_SES [BAA_SES] ON [BAA_SES].PAR_GUID = [BAA_SBJ].OBJ_GUID
              LEFT JOIN BAA_IMG [BAA_IMG] ON [BAA_IMG].PAR_GUID = [BAA_SES].OBJ_GUID
            WHERE [WHERE_CLAUSE] ORDER BY [BAA_SBJ].SBJ_NM">
        <cfset whr = "([BAA_SBJ].SBJ_NM CONTAINING TRIM( rm_srch_trm1 ) OR " &
                "[BAA_SBJ].NOTE CONTAINING TRIM(:prm_srch_trm2 ) OR " &
                "[BAA_SBJ].SBJ_DOB CONTAINING TRIM(:prm_srch_trm3 ) OR " &
                "[BAA_SES].SES_TYP CONTAINING TRIM(:prm_srch_trm4 ) OR " &
                "[BAA_SES].NOTE CONTAINING TRIM(:prm_srch_trm5 ) OR " &
                "[BAA_IMG].NOTE CONTAINING TRIM(:prm_srch_trm6 ))">
        <cfset sql_txt = Replace(sql_txt,"[WHERE_CLAUSE]", "#whr#", "ALL")>
        <cfset sql_txt = AbrvTblNms(sql_txt)>
    <!--- Through experimentation, I learned that each occurance of a param must be uniquely named.
              It would be very handy, if the param value was applied to *all* occurances of the param.
                    That way, I could get away with using one .addParam line instead of 6 --->
        <cfscript>
        queryService = new query();
        queryService.setDatasource("cfBAA_odbc");
        queryService.setName("qSBJs");
        queryService.setAttributes(sql="#sql_txt#");
        queryService.addParam(name="prm_srch_trm1", value="#srch_trm#", cfsqltype="VARCHAR");
        queryService.addParam(name="prm_srch_trm2", value="#srch_trm#", cfsqltype="VARCHAR");
        queryService.addParam(name="prm_srch_trm3", value="#srch_trm#", cfsqltype="VARCHAR");
        queryService.addParam(name="prm_srch_trm4", value="#srch_trm#", cfsqltype="VARCHAR");
        queryService.addParam(name="prm_srch_trm5", value="#srch_trm#", cfsqltype="VARCHAR");
        queryService.addParam(name="prm_srch_trm6", value="#srch_trm#", cfsqltype="VARCHAR");
        result = queryService.execute();
        qSBJs = result.getResult();
        </cfscript>       
        <!--- <cfquery name="qSBJs" datasource="cfBAA_odbc">
        </cffunction>
        </cfquery> --->
        <cfreturn qSBJs>
    </cffunction>
THANKS TO ADAM AND DAN FOR HELPIMG ME GET THIS FAR!  Now, don't let me embarass you by doing something dum and giving you "credit", if you see me doing something dum above.  Thanks!