magic_quotes_gpc setting for ColdFusion? ColdBox? - mysql

Question

I am new to ColdFusion and want to remove single quotes from the values of my input fields. I tried to search on google and what I found is to use "magic_quotes_gpc" or "mysql_real_escape_string" but those functions do not exist in ColdFusion. Is there any way to handle this kind of mysql query injection in ColdFusion?
Updated:
Thank you for reply but please look at my code
<div class="form-group">
<label for="jobDesc">Job description</label>
<textarea name="description" class="form-control" rows="3" id="jobDesc">
<cfif isdefined('userTime')>#userTime.description#</cfif>
</textarea>
</div>
I just want to use single quotes in the text area and my form is submitting to event. The query is:
sqlstr = "";
sqlstr = "insert into usertime set
userid = '#arguments.userTimeParams.userid#',
projectid = '#arguments.userTimeParams.projectid#',
timesheetdate = '#arguments.userTimeParams.timesheetdate#',
estimatedtimespent = '#arguments.userTimeParams.jobhours * 60 + arguments.userTimeParams.jobMins#',
description = '#arguments.userTimeParams.description#',
timeentered = #arguments.userTimeParams.timeentered#;";
queryObj = new query();
queryObj.setDatasource("timesheet");
queryObj.setName("adduserTime");
result = queryObj.execute(sql=sqlstr);
adduserTime = result.getResult();
return result.getPrefix().generatedKey;
I have one option that I can add slashes to my string, but then I have to add slashes in all strings. So is there any function or way to do this with less lines of code?
Sorry for asking much with limited knowledge.

Answer 1

Um... just don't pass your user input (or any other data ~) values hard-coded in your SQL statements, pass them as parameter values instead.
Example:
coloursViaQueryExecute = queryExecute("
SELECT en AS english, mi AS maori
FROM colours
WHERE id BETWEEN :low AND :high
",
{low=URL.low, high=URL.high},
{datasource="scratch_mssql"}
);
Where low and high are your parameters.
See relevant docs # QueryExecute()
And further reading on the topic:
What one can and cannot do with <cfqueryparam>
Query.cfc / queryExecute() have a good feature <cfquery> lacks

Answer 2

Without parameterizing the user data, you are opening yourself to SQL injection. The REReplace() may not catch everything. Here is how you should rewrite that code to use cfqueryparam. You may need to tweak the addParam() method calls to add the correct cfsqltype.
sqlstr = "";
sqlstr = "insert into usertime set
userid = :userid,
projectid = :projectid,
timesheetdate = :timesheetdate,
estimatedtimespent = :estimatedtimespent,
description = :description,
timeentered = :timeentered";
queryObj = new query();
queryObj.setDatasource("timesheet");
queryObj.setName("adduserTime");
queryObj.addParam( name="userid", value=arguments.usertimeparams.userid);
queryObj.addParam( name="projectid", value=arguments.usertimeparams.projectid);
queryObj.addParam( name="timesheetdate", value=arguments.usertimeparams.timesheetdate, cfsqltype="CF_SQL_TIMESTAMP");
queryObj.addParam( name="estimatedtimspent", value=arguments.userTimeParams.jobhours * 60 + arguments.userTimeParams.jobMins, cfsqltype="CF_SQL_INTEGER");
queryObj.addParam( name="description", value=arguments.usertimeparams.description);
queryObj.addParam( name="timeentered", value=arguments.usertimeparams.timeentered, cfsqltype="CF_SQL_INTEGER");
result = queryObj.execute(sql=sqlstr);
adduserTime = result.getResult();
return result.getPrefix().generatedKey;