ColdFusion adding extra quotes when constructing database queries in strings

ColdFusion, by design, escapes single quotes when interpolating variables within <cfquery> tags. To do what you want, you need to use the PreserveSingleQuotes() function. <cfquery …>#PreserveSingleQuotes(query)#</cfquery> This doesn’t address, however, the danger of SQL injection to which you are exposing yourself. Using <cfqueryparam> also allows your database to cache the query, which in most cases … Read more