title: form data into database: preventing SQL injection
body: <p>It has recently been mentioned to be that our method of inserting data into our SQL database via form submission is subject to SQL injection attacks, and want some advice to harden our security.</p>
  
  <p>Here's the code that inserts form data into the DB:</p>
  
  <pre><code>        &lt;cfquery name="InsRegistrant" datasource="#application.Datasource#" dbtype="odbc"&gt;
  
              INSERT INTO Schedule_Registrations(
                  schedule_id,
                  first_name,
                  last_name,
                  phone_number,
                  email,
                  guest,
                  list_type,
                  datetime_registered
               )
              VALUES(
                  #url.schedule_id#,
                  '#FORM.first_name#',
                  '#FORM.last_name#',
                  '#CleanPhoneNumber#',
                  '#FORM.email#',
                   #attendee.guest#,
                   &lt;!--- Values for list types 
                      0 = NEVER USE Will cause many many problems
                      1 = Main List
                      2 = Waiting List ---&gt;                    
                   #attendee.list_type#,
                   #createodbcdatetime(now())#
               )                
          &lt;/cfquery&gt;
  </code></pre>
  
  <p>CleanPhoneNumber is set this way:</p>
  
  <pre><code>&lt;cfset CleanPhoneNumber = REReplace(form.phone_number, "[^0-9]", "", "ALL") /&gt;
  </code></pre>
  
  <p>I've been told to use, for instance, </p>
  
  <pre><code>&lt;cfqueryparam cfsqltype="cf_sql_varchar" value="#form.phone_number#" /&gt;
  </code></pre>
  
  <p>but I'm not sure what to replace and where. When I replace the  values with such I get an error.</p>
  
  <p>Any direction would be helpful..</p>