Problem with a record deletion

[dmorand]

Ok, I've looked at this for a while now and I'm just not seeing what the issue is. I have a page which is setup to delete records from a table. I'm getting a CF error when I submit.

CF Error:

Attribute validation error for tag cfoutput.
The value of the attribute query, which is currently "delSystem" , is invalid.

The error occurred in C:\Inetpub\wwwr oot\Security_Ac cess\systemSubm it.cfm: line 25

23 :
24 : <cfif isDefined("URL. op") and URL.op IS "del">
25 : <cfoutput query="delSyste m">
26 : Record #sysID# deleted!
27 : </cfoutput>

Here is the code snippet:

<cfif isDefined("URL.op") and URL.op IS "del">
    <cfquery name="delSystem" datasource="Security_Access" dbtype="ODBC">
        delete from tblSystem
        where sysID=#URL.sysID#
    </cfquery>
    <cfoutput query="delSystem">
        Record #sysID# deleted!
    </cfoutput>
</cfif>
 

I don't see what the issue is because delSystem is named correctly, and the query does run because when I check the database table after, I see that the record gets deleted. This is the only query I'm having an issue with, and it's a delete query. Is there something special because I'm deleting?

[dmorand]

nevermind, I'm a moron...

I need to use #URL.sysID# not #sysID#

It's friday...no more coding for me

[Shift4SMS]

This is off-topic but your example is a perfect demonstration on how to create a sql injection and a cross site scripting vulnerability.

To prevent sql injections you should always use the VAL of a numeric values and escape string values of all URL or FORM variables. If you are not familiar with sql injection, here is an example using your sample code:

templatename.cf m?op=del&sysID= 0%20or%201%3D1

which will be processed in your query as:

    <cfquery name="delSystem" datasource="Security_Access" dbtype="ODBC">
        delete from tblSystem
        where sysID=0 or 1=1
    </cfquery>
 

which in turn will produce devistating result to you database. This is a simple example. If a hacker finds a sql injection door open, he or she can do much more damage than this. Correcting the problem is simple:

    <cfquery name="delSystem" datasource="Security_Access" dbtype="ODBC">
        delete from tblSystem
        where sysID=#Val(URL.sysID)
    </cfquery>
 

Cross site scripting or XSS is when a hacker can cause a client browser to display and execute unwanted and possibly dangerous scripting code. The part in your sample of concern is here:

templatename.cf m?op=del&sysID% 3Cscript%20lang uage%3D%22JavaS cript%22%20type %3D%22text%2Fja vascript%22%3Ea lert%28%22You%2 7re%20screwed%2 1%22%29%3B%3C%2 Fscript%3E

which will process in your display block as:

          <cfoutput query="delSystem">
              Record <script language="JavaScript" type="text/javascript">alert("You're screwed!");</script> deleted!
          </cfoutput>
 

XSS is harder to prevent than sql injection. The site www.owasp.org details both these vulnerabilities more and have links to even more info. I highly recommend that you research this further.

[acoder]

Excellent info. Do you think you could write a quick article based on this?

[dmorand]

Wow, that's very handy. I'm pretty safe because I'm behind a firewall. This is our company intranet site, but I will definitely make note of this and use this in my code from now on.