CFForm vs. form in Coldfusion

Question

I have been using simple forms and input fields in coldfusion for some time, but recently discovered that cfinput tags automatically prevent some xss attacks for me. This made me wonder if there are any flaws in using cffrom and cfinput over the normal form and input tags in coldfusion.

The only drawback I found in a short time is that it adds 2 external stylesheets and 1 script to the page.

so shorter:

What are the advantages and disadvantages of using CFFORM compared to cold form?

Answer 1

JS . cfform , ( ..), cfform. JS, JS .

, , , , , cfform. .

, - ( ), , JS, cfform, JS.

, , . "" "" cfform . , , /.

Answer 2

- <cfform> <cfinput>.

xss, CFFORM, htmlEditFormat() = "" :

<input name="x" value="#htmlEditFormat(x)#">

XSS OWASP Enterprise Security API (.jar, CF9)

, ajaxified JS, , JavaScript JS css - . cfform , ( ).

, ajax, checked, CF- , , cfinput cfselect , .

. <cfform> , . .

Answer 3

ColdFusion 14 . , CF , , , - .

CFFFORM, CFINPUT, CFLAYOUT, CFPOD - , . , . -, . .

, , . , . .

ColdFusion 9/jQuery/SQL Server, -. . CFSCRIPT. !

jQuery, . . CFSCRIPT.

<cfscript>
Options = "";
for (i = 1; i lte 10; i++) {
  Options = Options & wrapOption("Some choice #i# ", i);
}
SelectBox = wrapSelect(Options, "MySelectID");
writeOutput(SelectBox);
SecretDiv = wrapDiv("", "", "MyDivID");
writeOutput(SecretDiv);
</cfscript>

HTML UDF_Library.cfm:

// WRAP SELECT
function wrapSelect(SelectContent, Class, ID) {
    LOCAL.SelectContent = ARGUMENTS.SelectContent;
    LOCAL.Properties = "";
    // CLASS
    if (isDefined("ARGUMENTS.Class")) {
        LOCAL.Properties = LOCAL.Properties & " class='#ARGUMENTS.Class#'";
    }
    // ID
    if (isDefined("ARGUMENTS.ID")) {
        LOCAL.Properties = LOCAL.Properties & " id='#ARGUMENTS.ID#'";
    }
    LOCAL.Item = "<select #LOCAL.Properties#>#LOCAL.SelectContent#</select>";
    return LOCAL.Item;
}
// WRAP OPTION
function wrapOption(Content, Value, Selected) {
    LOCAL.Content = ARGUMENTS.Content;
    LOCAL.Properties = " value='#ARGUMENTS.Value#'";
    // SELECTED
    if (isDefined("ARGUMENTS.Selected") and (ARGUMENTS.Selected eq "selected")) {
        LOCAL.Properties = LOCAL.Properties & " selected";
    }
    LOCAL.Item = "<option #LOCAL.Properties#>#LOCAL.Content#</option>";
    return LOCAL.Item;
}
// CREATE DIV
function wrapDiv(Content, Class, ID) {
    LOCAL.Properties = "";
    // CLASS
    if (isDefined("ARGUMENTS.Class")) {
        LOCAL.Properties = LOCAL.Properties & " class='#ARGUMENTS.Class#'";
    }
    // ID
    if (isDefined("ARGUMENTS.ID")) {
        LOCAL.Properties = LOCAL.Properties & " id='#ARGUMENTS.ID#'";
    }
    LOCAL.Item = "<div #LOCAL.Properties#>#ARGUMENTS.Content#</div>";
    return LOCAL.Item;
}

jQuery . , ajax, :

<script type="text/javascript">
$(document).ready(function() {
$("#MySelectID").change(function() {
   MyID = $("#MySelectID").val();
   $("#MySecretDiv").load("CoolQuery.cfm?UserID"+MyID);
});


});
</script>

, , CFFORM CFINPUT, jQuery. .

2012 ColdFusion jQuery!!!

!

Answer 4

ColdFusion CFInput . jQuery Validation, , :

• ? (.. , , , .)
• ? (.. "", .)
• /? (.. DateJS, )
• ajax
• URL?
• 1 2
• ,

:

<input type="text" name="Name" class="required">
<input type="text" name="Birthdate" class="required date">
<input type="text" name="Email" class="required email">
<input type="text" name="Website" class="url">

I prefer to use jQuery because sometimes I need to add the same logic to a form other than ColdFusion, and I don’t have to worry about CFInput being a ColdFusion-Only tag.

Here is a link to additional information about the jQuery validation library:

http://bassistance.de/jquery-plugins/jquery-plugin-validation/