How to programmatically sanitize cfquery ColdFusion settings?

Question

I have inherited the great legacy of ColdFusion. There are hundreds of <cfquery> some sql here # variable # </cfquery> which should be parameterized according to: <cfquery> some sql here <cfqueryparam value = "# variable #" /> </cfquery>

How can parameterization be added programmatically?

I was thinking of writing some kind of regular expression or sed / awk solution, but it seems like someone has handled such a problem somewhere. Bonus points are awarded for automatically detecting the sql type.

Answer 1

queryparam, RIAForge: http://qpscanner.riaforge.org/

Answer 2

script: http://www.webapper.net/index.cfm/2008/7/22/ColdFusion-SQL-Injection, . , , , .

, CFQueryParam, , , .

Answer 3

, <cfqueryparam> .

, , , "".

Answer 4

<cf_inputFilter
            scopes = "FORM,COOKIE,URL"
            chars = "<,>,!,&,|,%,=,(,),',{,}"
            tags="script,embed,applet,object,HTML">

We used this to counteract the recent SQL injection attack. We added it to the Application.cfm file for our site.

Answer 5

I doubt there is a solution that exactly fits your needs. The only option that I see is to write your own recursive search that creates a report for you or uses one of the applications / scripts listed above. Basically, you will have to edit each page or approve all automatic changes.