Applications that depend on user input to create a SQL statement — concatenating the user input to the SQL query — can become vulnerable to SQL Injection attacks, much like those common to web applications.

SQL Injection is a technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

Fortunately, there is a simple solution to the problem: use parameterised SQL Statements. Parameterised statements not only make your applications more secure and run more efficiently, but they also enable you to use objects, rather than literal values, in your queries. SQL injection can’t happen because the parameter values are treated explicitly as substituted values, rather than becoming part of the literal statement text.

Parameters in a SQL statement can be either named or unnamed. Below are examples of both types of statement in ActionScript and JavaScript.

Named Parameters

A named parameter has a specific name that is used to match the parameter value to its placeholder location in the SQL statement text. A parameter name consists of the colon (:) or an at (@) character followed by the variable’s name:

ActionScript 3

var conn:SQLConnection = new SQLConnection();
var stmt:SQLStatement = new SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO user VALUES(@title, @firstname, @lastname)";
stmt.parameters["@title"] = "Mr";
stmt.parameters["@firstname"] = "Simon";
stmt.parameters["@lastname"] = "Whatley";
stmt.execute()

JavaScript

var conn = new air.SQLConnection();
var stmt = new air.SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO user VALUES(@title, @firstname, @lastname)";
stmt.parameters["@title"] = "Mr";
stmt.parameters["@firstname"] = "Simon";
stmt.parameters["@lastname"] = "Whatley";
stmt.execute()

Unnamed Parameters

As an alternative to using explicit named parameters, you can also use implicit unnamed parameters. To use an unnamed parameter you simply designate a parameter in the SQL statement using a question mark (?) character. Each parameter is assigned a numeric index, according to the order in which the parameters appear in the SQL statement, starting with index 0 (zero) for the first parameter.

ActionScript 3

var conn:SQLConnection = new SQLConnection();
var stmt:SQLStatement = new SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO address VALUES(?, ?, ?, ?)";
stmt.parameters[0] = "123 Main Street";
stmt.parameters[1] = "Sometown";
stmt.parameters[2] = "12345";
stmt.parameters[3] = "USA";
stmt.execute()

JavaScript

var conn = new air.SQLConnection();
var stmt = new air.SQLStatement();
stmt.sqlConnection = conn;
stmt.text = "INSERT INTO address VALUES(?, ?, ?, ?)";
stmt.parameters[0] = "123 Main Street";
stmt.parameters[1] = "Sometown";
stmt.parameters[2] = "12345";
stmt.parameters[3] = "USA";
stmt.execute()

Note: Use clearParameters() to empty the statement parameters array; e.g. stmt.clearParameters().

Advantages

1. Performance – A SQL statement that uses parameters can execute more efficiently compared to one that dynamically creates the SQL text each time it executes. The performance improvement is because the statement is prepared once and then executed multiple times using different parameter values, without needing to recompile the SQL statement. A comparison can be draw with database stored procedures.
2. Data Typing – Parameters are used to allow for typed-substitution of values that are unknown at the time the SQL statement is constructed. The use of parameters is the only way to guarantee the type (storage class) for a value passed to the database. Using paramters therefore, implies better performance and security. When parameters are not used, the runtime attempts to convert all values from their text representation to a type based on the associated column’s type.
3. Security – The AIR application is not vulnerable to SQL injections so common to web applications.

So who could the contenders be? Here are two extremely promising applications built on the Flash platform:

SlideRocket

SlideRocket is a rich Internet application, built on the Flash platform, that provides for every part of the presentation lifecycle. It integrates authoring, asset management, delivery and analytics tools into a single hosted environment that allows you to quickly create stunning presentations, intelligently manage your assets, securely share your slides, and measure the results.

There are already a number of companies that are striving to be the web-based presentation application of choice, including Google, Zoho and Empressr.

SlideRocket is the first online productivity application that embraces business level features such as collaboration, robust security, dynamic data binding and business integration with applications like Salesforce.com. SlideRocket aims to differentiate itself from other presentation products by including a community marketplace where content and services can be shared and transacted. SlideRocket also embraces the best of the Internet with features like asset tagging, web content mashups, embedded data services and seamless rich media support.

It’s absolutely one of the best presentation creation applications out there. And because it’s built on rich Internet application technologies you can add interactivity and create a cinematic experience that I haven’t seen done any where else.

Ryan Stewart, Adobe’s Rich Internet Evangelist writing in ZDNet – SlideRocket – the king of presentation applications.

(click on the images for more detail)

SlideRocket has been designed from the ground up with extensibility and portability in mind as well. To this effect, third party developers will be able to build components into slideshows using the application’s APIs, creating compelling presentations.

You can find more information on the SlideRocket website.

blist

Blist makes it easy for anyone to create private or collaborative databases.

Blist is not alone in the online database market. Zoho DB, DabbleDB and Trackvia are all web-based tools that provide users the ability to create and administer databases.

Although Blist’s simplicity makes it seem like you’re not dealing with anything more complicated than an online spreadsheet, the Blist user interface is actually hiding a complex relational database backend.

Unlike other online database systems, such as Zoho DB, using Blist doesn’t require the user to know SQL to use all it has to offer. This makes Blist great for users who need more than an Excel spreadsheet, but who don’t want to delve into the complexities of a database software application like Access.

(click on the images for more detail)

Blist’s focus on making database creation and management a straightforward process, built on an always available, rich Internet application suggests it can fill a niche. Demand will prove the depth of such a niche, but if it grabs enough attention from people as regular users, it will become an extremely interesting prospect for acquisition.

You can find more information on the blist website.

In object-oriented programming, programming objects represent real-world objects. To illustrate, consider the example of an address book, which contains listings of people along with zero or more phone numbers and zero or more addresses. In object-oriented terms this would be represented by a “person object” with “slots” (fields, members, instance variables etc.) to hold the data that make up this listing: the person’s name, a list (or array) of phone numbers, and a list of addresses.

The crux of the problem is in translating those objects to forms which can be stored in files or databases, and which can later be retrieved easily while preserving the properties of the objects and their relationships; these objects can then be said to be persistent.

Object-Relational systems attempt to solve this problem by providing libraries of classes which are able to do this mapping automatically. Given a list of tables in the database, and objects in the program, they will automatically map requests from one to the other. Asking a person object for its phone numbers will result in the proper query being created and sent, and the results being “magically” translated directly into phone number objects inside the program.

From a programmer’s perspective, the system looks like a persistent object store. One can create objects and work with them as one would normally, and they automatically end up in the relational database.

A number of ORM frameworks have been created for ColdFusion:

Reactor

Reactor, created by Doug Hughes of Alagad fame, is a very simple API for ColdFusion which generates and instantiates database abstraction CFCs on the fly as needed.

http://www.doughughes.net/

Arf!

Active Record Factory (Arf!) is a Rails-style ActiveRecord implementation in ColdFusion.

Below is a list of the basics that Arf! provides:

• JDBC metadata based reflection: not database specific

• Creates ActiveRecord API‘d instances out of CFCs that extend a base ActiveRecord component

• Implements hasMany() and belongsTo() methods for establishing Record properties that point to other tables

• Allows for overloading any of the automagically generated methods to add custom business logic

• Automagic methods on Records include GetInstance(), Create(), Read(), Update(), Delete(), Save() [smart create/update], List(orderBy, whereClause), Validate() [does type and length checking], and SetNNN()/GetNNN() methods for each DB column

http://www.clearsoftware.net/

objectBreeze

Developed by Nicholas Tunney, objectBreeze is an ORM tool that allows you to interact with your data persistence layer and easily model objects within your ColdFusion applications. With no setup, objectBreeze will instantly create objects directly from your database schema. objectBreeze requires that your table has -a- primary key defined. Currently, objectBreeze works with Microsoft SQL, Oracle, MySQL and PostgreSQL, but other versions are on the way.

http://www.objectbreeze.com/ob/

cfcPowerTools

Batch generation of your data layer objects in minutes.

http://cfcpowertools.riaforge.org/

Transfer

Transfer was built out of a need to speed up the development process that is normally slowed down by the development of Business Objects and Data Access Objects.

Transfer does this through a series of methods, including SQL generation and CFML code generation, that all occur during the run-time process.

All this is configured through a XML file, that maps your object generation back to the tables and columns in your database.

http://www.compoundtheory.com/

However, there are situations where you cannot use the full-text searching capabilities of Verity. For example, Verity only runs on Windows, Linux and Solaris, therefore the ability to run ColdFusion MX on the Apple OS X operating system, whilst advantageuos to developers who code on the Apple platform, does not include the ability to use Verity. Furthermore, programmers who work in a hybrid J2EE/ColdFusion MX environment cannot natively use the Verity search capabilities in the J2EE environment. Finally, programmers who need customized searching and indexing capabilities may find the standard Verity integration limiting. There are work-arounds include installing Verity on a Windows, Linux, or Solaris server and configuring your ColdFusion server to use the remote Verity server, however these may not only be impractical, but cost-prohibitative.

Enter Lucene, an open source full-text searching framework from the Apache Jakarta project, which, when combined with ColdFusion MX, can be run on Apple OS X, can be programmatically accessed by both J2EE and ColdFusion MX developers, and can be fully customized and extended.Apache Lucene is a high-performance, full-featured text search engine library written entirely in Java. It is a technology suitable for nearly any application that requires full-text search, especially cross-platform.

Apache Lucene is an open source project available for free download.

Features

• Lucene offers powerful features through a simple API.

Scalable, High-Performance Indexing

• Over 20MB/minute on Pentium M 1.5GHz
• Small RAM requirements — only 1MB heap
• Incremental indexing as fast as batch indexing
• Index size roughly 20-30% the size of text indexed

Powerful, Accurate and Efficient Search Algorithms

• Ranked searching — best results returned first
• Many powerful query types: phrase queries, wildcard queries, proximity queries, range queries and more
• Fielded searching (e.g., title, author, contents)
• Date-range searching
• Sorting by any field
• Multiple-index searching with merged results
• Allows simultaneous update and searching

ColdFusion & Lucene Implementations

If you don’t fancy attempting the task of writing your own ColdFusion implementation of Lucene, below are a couple of projects that will give you a kick-start along the road to indexing database content. With the addition of other Java projects such as PDFBox the textual content of a pdf can also be extracted and indexed.

Aaron Johnson

Inspired by Lindex, Aaron Johnson has created a CFX Tag called CFX_Lucene that closely mimics the ColdFusion cfsearch tag, but uses Lucene rather than Verity.

http://cephas.net/blog/lucene/index.html

CFLucene

CFLucene is an open source project that attempts to provide developers an easy way to integrate the indexing and searching functions of the Apache Lucene Java library with a ColdFusion web application. The CFLucene is a collection of ColdFusion Components that natively call the Lucene Java classes to index and search any sort of textual data.

http://www.cflucene.org/