Here's one for ya.

I've been getting alot of attempted SQL injection attacks. People are passing long web urls like:
http://www.fabcraft.co.uk/forum/lovuqo/zil/

into my "BrandID or "CategoryID" URL param and it is blowing up my site because the <cfqueryparam> is enforcing the data type. I probably get 4 dozen errors a day, each attempt is contains a different URL. And if you visit any of the urls, they all just output text that reads.



I know what the whole md5 stuff is, but why just echo that string? What are they trying to accomplish? and why PHP to a Coldfusion site? Grated these are only select statements they are hitting so they wouldn't get anywhere.

Strange...

They're starting with that for the sake of only testing for vulnerabilities. It's quick and simple and will provide them with what they "need" to continue their efforts.

As far as these attempts causing your app to bomb, how about including some error handling into your app? You can start with Try/Catch.



Also, I commend you on using parameterized queries. There are ALOT of CF "coders" out there that still concatenate.