title: ColdFusion 9: int and type="numeric" nasty bug?
body: <p>I've just experienced a behaviour that defies any logic and could potentially lead to serious issues and was wondering if <strong>it was a bug or if the behaviour was itended and what are the best practices to circumvent the issue? If it's a bug, is there a patch?</strong></p>
  
  <p>Here's the two wierd behaviours that when put together are a threat to any system's data integrity.</p>
  
  <ol>
  <li><code>int('1 2')</code> -> <code>41276</code></li>
  <li><code>isValid('numeric', '1 2')</code> -> <code>true</code></li>
  </ol>
  
  <p>Why? Well let's see...</p>
  
  <pre><code>&lt;cffunction name="deleteSomething" access="public" returntype="void"&gt;
      &lt;cfargument name="somethingId" type="numeric" required="yes"&gt;
  
      &lt;cfquery datasource="#dsn()#"&gt;
          DELETE
          FROM Something
          WHERE id = &lt;cfqueryparam cfsqltype="cf_sql_integer" value="#arguments.somethingId#"&gt;;   
      &lt;/cfquery&gt;
  
  &lt;/cffunction&gt;
  
  
  &lt;cfset deleteSomething('1 2')&gt;
  </code></pre>
  
  <p>Here, the <code>type="numeric"</code> arguments validation (which perhaps is based on the same algorithm as <code>isValid</code>?) doesn't throw with  <code>'1 2'</code>. Even worse, <code>cfqueryparam cfsqltype="cf_sql_integer"</code> seems to be using <code>int</code> to convert the value which will end up being <code>41276</code>.</p>
  
  <p>In other words, <code>deleteSomething('1 2')</code> will delete the entity with id <code>41276</code> instead of throwing an exception since the value <code>1 2</code> is obviously not numeric.</p>
  
  <p>Now, the only fix I thought of is to perform additionnal argument validation using <code>isValid('integer', ...</code> or a regular expression, but that's a real pain and besides, I never understood why they haven't implemented <code>type="integer"</code>?</p>
  
  <p>Obviously, I also always made the false assumption that <code>cfqueryparam type="cf_sql_integer"</code> would validate that the value passed is a valid integer.</p>
  
  <p>EDIT:</p>
  
  <p>It seems that even <code>isvalid('integer', ...</code> is also not reliable as we can see in<br>
  <a href="https://stackoverflow.com/questions/11535979/why-isvalidinteger-1-5-yes">Why isvalid(&quot;integer&quot;,&quot;1,5&quot;) = YES?</a></p>
  
  <p>EDIT2:</p>
  
  <p>I know that I could add additionnal arguments validation for every expected integer argument in every function, however that would require to fix a huge code base in my case and it's also very error-prone. It also makes the built-in argument validation completely useless in this case.</p>
  
  <p>I would rather prefer a solution where I could <strong>create and apply an unofficial patch</strong>. Is that a realistic option? If so I would like to be pointed out in the right direction.</p>
  
  <p>EDIT3: It doesn't solves all the problems, but CF11 added support for a <a href="https://helpx.adobe.com/coldfusion/cfml-reference/coldfusion-tags/tags-a-b/cfapplication.html" rel="nofollow noreferrer">strictNumberValidation</a> application level configuration.</p>
  
  <blockquote>
    <p>"Starting from ColdFusion 11, this function evaluates on a more strict
    basis. Setting this value to false makes the isValid function to
    behave in the older way. This setting effects cfargument, cfparam and
    cfform tags wherever integer &amp; numeric validation is used. Based on
    this setting, the validation reflects in those tags as well."</p>
  </blockquote>