Cast as integer in ColdFusion; sanitizing variables

Question

I'm rusty at ColdFusion, I've been used to PHP for so long. What I want to do is something like this:

<?php
  $id = (isset($_GET['id'])) ? (int)$_GET['id'] : 0;
?>

Basically, check for a url parameter called id and if it exists make sure it's an integer so I can safely use it in database queries. If it ends up zero, that's fine too.

I have:

<cfscript>
if (IsDefined("URL.id") AND IsNumeric(URL.id)) {
    id = int(URL.id);
} else {
    id = 0;
}
</cfscript>

This is working, but is awfully messy. Is there a better way to do this?

Answer 1

You can use IIF. It's cool.

<cfset id = IIf(IsDefined("URL.id") AND Int(URL.id), Int(URL.id), DE("0"))>

Answer 2

You might also look into cfparam.

<cftry>
  <cfparam name="url.id" default="0" type="integer">
<cfcatch>
  <!--- log? etc --->
  <cfset url.id = 0>
</cfcatch>
</cftry>

Answer 3

I would use cfparam. I'd also scope explicitly, but that's not necessary. I wouldn't use the IIF() function, because it makes use of evaluate(), which can be problematic, I'd also avoid DE() for the same reason. In this case, it won't be an issue, but I avoid them on general principle in any situation where it's not absolutely necessary. I've been using CF for a few years now, and it hasn't been necessary yet.

<cfparam name="url.id" default="0" />

<cfif isNumeric(url.id)>
    <cfset local.id = int(url.id) />
<cfelse>
    <cfset local.id = 0 />
</cfif>

Answer 4

Recent versions of ColdFusion also have a ternary conditional operator:

<cfset id = (structKeyExists(URL, "id") and isNumeric(URL.id)) ? int(URL.id) : 0>

Answer 5

To me, the simplest way to ensure your variable is an integer is to wrap the variable in val().

It attempts to parse the string and extract any integer found (at the beginning of the string). If none is found it returns 0.

• If TestValue = "234A56?7'", Val(TestValue) returns 234.
• If TestValue = "234'5678'9?'", Val(TestValue) returns 234.
• If TestValue = "BG234", Val(TestValue) returns the value 0, (not an error).
• If TestValue = "0", Val(TestValue) returns the value 0, (not an error).

See http://cfquickdocs.com/cf8/#Val