Recently, a security risk company we hired identified a SQL injection risk for a specific parameter of a function in our Coldfusion application. The argument is correctly captured as a cfargument:

```
<cfargument name="status" required="false" type="string">

```

and also correctly paramed as a cfprocparam:

```
<cfif isDefined('ARGUMENTS.status') AND ARGUMENTS.status NEQ "">
    <cfprocparam  type="in" value="#ARGUMENTS.status#" dbvarname="@search_status" cfsqltype="cf_sql_varchar">
<cfelse>
    <cfprocparam  type="in" null="yes" dbvarname="@search_status" cfsqltype="cf_sql_varchar">
</cfif>

```

And then it's used in the stored proc this way, building a where clause for a SQL query:

```
if (len(@search_status) > 0)
    begin
        set @strWhere = @strWhere + ' AND e1.cps_txt LIKE '+ '''%'+@search_status+'%'''
    end

```

Of course, paraming to make sure the value is a varchar can't prevent a string of malicious code being entered and passed. This seems like it could easily be a larger problem, too, since it's far from the only place in our application where string arguments are passed to cfc functions and then used in SQL queries.

I'm wondering if the best approach to remedy the security risk in this one case is to compare the argument's value to all of the possible expected values (there's about twenty of them, stored in a table), and if it doesn't match one of them, then to throw an error, or just pass to the stored proc as null.