<p>I have been tasked with going through a number of ColdFusion sites that have recently been the subject of a rather nasty SQL Injection attack.  Basically my work involves adding <code>&lt;cfqueryparam</code>> tags to all of the inline sql.  For the most part I've got it down, but can anybody tell me how to use cfqueryparam with the LIKE operator?</p>

<p>If my query looks like this:</p>

<pre><code>select * from Foo where name like '%Bob%'
</code></pre>

<p>what should my <code>&lt;cfqueryparam</code>> tag look like?</p>

[{'answer_id': 47197, 'author': 'Adam Tuttle', 'author_id': 751, 'author_profile': 'https://Stackoverflow.com/users/751', 'pm_score': 7, 'selected': True, 'text': '<p>@Joel, I have to disagree.</p>\n\n<pre><code>select a,b,c\nfrom Foo\nwhere name like &lt;cfqueryparam cfsqltype="columnType" value="%#variables.someName#%" /&gt;\n</code></pre>\n\n<ol>\n<li><p>Never suggest to someone that they should "select star." Bad form! Even for an example! (Even copied from the question!)</p></li>\n<li><p>The query is pre-compiled and you should include the wild card character(s) as part of the parameter being passed to the query. This format is more readable and will run more efficiently.</p></li>\n<li><p>When doing string concatenation, use the ampersand operator (&amp;), not the plus sign. Technically, in most cases, plus will work just fine... until you throw a NumberFormat() in the middle of the string and start wondering why you\'re being told that you\'re not passing a valid number when you\'ve checked and you are.</p></li>\n</ol>\n'}, {'answer_id': 16583567, 'author': 'Ramalinga Raju', 'author_id': 2358182, 'author_profile': 'https://Stackoverflow.com/users/2358182', 'pm_score': 0, 'selected': False, 'text': '<pre><code>select a,b,c\nfrom  Foo\nwhere name like  &lt;cfqueryparam cfsqltype="cf_sql_varchar" value="%Bob%" /&gt;;\n</code></pre>\n'}]
['https://Stackoverflow.com/questions/46571', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3271/']