Cfquery causing XSS and SQL Injection issues

Question

I ran an application scan (IBM) recently and now I'm trying to fix the issues that came up. A good majority of my issues stem from a cfquery (see below). I'm trying to get it so that Stored XSS and SQL injections issues don't show up on my scans. Any help would be greatly appreciated, as this is my first time doing something of the sort.

Thanks!

<cfquery name="enter_question" datasource="#dsn#">
INSERT INTO xx_questions(q_id,
                      q_name,
                  q_narrative,
                  q_used,
                  q_type)
VALUES(               #variables.new_q_id#,
                      '#form.q_name#',
                  '#form.q_narrative#',
                  'n',
                  #form.q_type#)
</cfquery>

Answer 1

You need to use <cfqueryparam>. Check the documentation at: https://wikidocs.adobe.com/wiki/display/coldfusionen/cfqueryparam

Try something like this (you should change the CFSQLType to match whatever your DB columns are):

<cfquery name="enter_question" datasource="#dsn#">
    INSERT INTO xx_questions(q_id,
        q_name,
        q_narrative,
        q_used,
        q_type)
    VALUES(
        <cfqueryparam value="#variables.new_q_id#" CFSQLType="CF_SQL_INTEGER">,
        <cfqueryparam value="#form.q_name#" CFSQLType="CF_SQL_VARCHAR">,
        <cfqueryparam value="#form.q_narrative#" CFSQLType="CF_SQL_VARCHAR">,
        <cfqueryparam value="n" CFSQLType="CF_SQL_CHAR">,
        <cfqueryparam value="#form.q_type#" CFSQLType="CF_SQL_INTEGER">
        )
</cfquery>