<p>I have inherited a large legacy ColdFusion app.  There are hundreds of &lt;cfquery&gt;some sql here #variable#&lt;/cfquery&gt; statements that need to be parameterized along the lines of: &lt;cfquery&gt; some sql here &lt;cfqueryparam value="#variable#"/&gt; &lt;/cfquery&gt;</p>

<p>How can I go about adding parameterization programmatically?</p>

<p>I have thought about writing some regular expression or sed/awk'y sort of solution, but it seems like somebody somewhere has tackled such a problem.  Bonus points awarded for inferring the sql type automatically.</p>

[{'answer_id': 64538, 'author': 'Joe Zack', 'author_id': 8724, 'author_profile': 'https://Stackoverflow.com/users/8724', 'pm_score': 3, 'selected': False, 'text': '<p>There\'s a queryparam scanner that will find them for you on RIAForge: <a href="http://qpscanner.riaforge.org/" rel="nofollow noreferrer">http://qpscanner.riaforge.org/</a></p>\n'}, {'answer_id': 65073, 'author': 'Dan Wilson', 'author_id': 8823, 'author_profile': 'https://Stackoverflow.com/users/8823', 'pm_score': 3, 'selected': False, 'text': '<p>There is a script referenced here: <a href="http://www.webapper.net/index.cfm/2008/7/22/ColdFusion-SQL-Injection" rel="noreferrer">http://www.webapper.net/index.cfm/2008/7/22/ColdFusion-SQL-Injection</a>  that will do the majority of the heavy  lifting for you. All you have to do is check the queries and make sure the syntax will parse properly.</p>\n\n<p>There is no excuse for not using CFQueryParam, apart from it being much more secure, it is a performance boost and the best way to handle quoted values in character based column types.</p>\n'}, {'answer_id': 72772, 'author': 'betelgeuce', 'author_id': 366182, 'author_profile': 'https://Stackoverflow.com/users/366182', 'pm_score': 1, 'selected': False, 'text': '<pre><code>&lt;cf_inputFilter\n            scopes = "FORM,COOKIE,URL"\n            chars = "&lt;,&gt;,!,&amp;,|,%,=,(,),\',{,}"\n            tags="script,embed,applet,object,HTML"&gt;\n</code></pre>\n\n<p>We used this to counteract a recent SQL injection attack. We added it to the Application.cfm file for our site.</p>\n'}, {'answer_id': 73705, 'author': 'kooshmoose', 'author_id': 7436, 'author_profile': 'https://Stackoverflow.com/users/7436', 'pm_score': 0, 'selected': False, 'text': '<p>I doubt that there is a solution that will fit your needs exactly. The only option I see is to write your own recursive search that builds a report for you or use one of the apps/scripts that people have listed above. Basically, you are going to have to edit each page or approve all of the automated changes.</p>\n'}, {'answer_id': 78134, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 2, 'selected': False, 'text': '<p>Keep in mind that you may not be able to solve everything with &lt;cfqueryparam&gt;.  </p>\n\n<p>I\'ve seen a number of examples where the order by field name is being passed in the query string, which is a slightly trickier problem to solve as you need to validate that in a more "manual" way.</p>\n'}]
['https://Stackoverflow.com/questions/64432', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/8563/']