cfquery to queryExecute: if inside SQL string [closed] - coldfusion

Question

Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 6 years ago.
Improve this question
what is the best way to do what I did in <cfquery> even in queryExecute
cfquery
<cfquery name="qry">
SELECT * FROM tbl_products
WHERE filed1 = 1
<cfif structKeyExists(URL, "test")>
AND filed2 = 2
</cfif>
ORDER BY id DESC
</cfquery>
cfexecute
<cfscript>
sql = "
SELECT * FROM tbl_products
WHERE filed1 = 1
ORDER BY id DESC
";
if (structKeyExists(URL, "test")){
sql = "
SELECT * FROM tbl_products
WHERE filed1 = 1
AND filed2 = 2
ORDER BY id DESC
";
}
qry = queryExecute(
sql = sql
);
</cfscript>
I hope I've explained myself well...

Answer 1

You have to build up the SQL string. Also well worth passing in the param values, so that you are protected from SQL injection. Something like:
<cfscript>
params = {};
sql = "
SELECT * FROM tbl_products
WHERE filed1 = :filed1
";
params["filed1"] = 1;
if (structKeyExists(URL, "test")){
sql &= "AND filed2 = :filed2 ";
params["filed2"] = 2;
}
sql &= "ORDER BY id DESC";
queryExecute(sql, params);
</cfscript>
Alternatively, you can use positional parameters.
<cfscript>
params = [];
sql = "
SELECT * FROM tbl_products
WHERE filed1 = ?
";
arrayAppend(params, 1);
if (structKeyExists(URL, "test")){
sql &= "AND filed2 = ? ";
arrayAppend(params, 2);
}
sql &= "ORDER BY id DESC";
queryExecute(sql, params);
</cfscript>
This is one of the times where tags is better than script.