title: magic_quotes_gpc setting for ColdFusion? ColdBox?
body: <p>I am new to ColdFusion and want to remove single quotes from the values of my input fields. I tried to search on google and what I found is to use "magic_quotes_gpc" or  "mysql_real_escape_string" but those functions do not exist in ColdFusion. Is there any way to handle this kind of mysql query injection in ColdFusion?</p>
  
  <p><strong>Updated:</strong></p>
  
  <p>Thank you for reply but please look at my code</p>
  
  <pre><code>&lt;div class="form-group"&gt;
      &lt;label for="jobDesc"&gt;Job description&lt;/label&gt;
      &lt;textarea name="description" class="form-control" rows="3" id="jobDesc"&gt;
          &lt;cfif isdefined('userTime')&gt;#userTime.description#&lt;/cfif&gt;        
     &lt;/textarea&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>I just want to use single quotes in the text area and my form is submitting to event. The query is:</p>
  
  <pre><code> sqlstr = "";
            sqlstr = "insert into usertime set
            userid = '#arguments.userTimeParams.userid#',
            projectid = '#arguments.userTimeParams.projectid#',
            timesheetdate = '#arguments.userTimeParams.timesheetdate#',
            estimatedtimespent = '#arguments.userTimeParams.jobhours * 60 + arguments.userTimeParams.jobMins#',
            description = '#arguments.userTimeParams.description#',
            timeentered = #arguments.userTimeParams.timeentered#;";
  
              queryObj = new query();
              queryObj.setDatasource("timesheet");
              queryObj.setName("adduserTime");
              result = queryObj.execute(sql=sqlstr);
              adduserTime = result.getResult();
              return result.getPrefix().generatedKey;
  </code></pre>
  
  <p>I have one option that I can add slashes to my string, but then I have to add slashes in all strings. So is there any function or way to do this with less lines of code?</p>
  
  <p>Sorry for asking much with limited knowledge.</p>