<cfqueryparam list="true" ... > inconsistency between ACF and Lucee

Description

There is a difference in behaviour between Adobe ColdFusion and Lucee when processing a query with SELECT/DELETE when using <cfqueryparam list="true" ...>.

In particular, if the specified list is empty then Adobe ColdFusion casts the list to an empty string and returns ALL rows; whereas in Lucee the empty list is cast to NULL and it returns zero rows. I verified this with SQL Profiler.

The same behavior can be seen when directly running the query on MSSQL Management Studio using empty string versus NULL.

The expected behaviour of doing a SELECT/DELETE ... WHERE Column NOT IN () is that all rows would be selected/deleted.

Modifying Lucee to follow this pattern would also remove the need to put <cfif> statements around the relevant WHERE clause to guard against this scenario.

Status

Assignee

Igal Sapir

Reporter

Ben Reid

Labels

None

Sprint

Affects versions

5.3.3.60

Priority

New
Configure