SQL Injection attacks

First thing to say about this subject is this: If you aren't using stored procedures and scoping your variables with cfprocparam or cfqueryparam (if you use a plain ol' query) then you are moments away from a SQL injection attack and a potential total loss of data.

[More]

The conversion of the varchar value overflowed an int column. Maximum integer value exceeded.

I just spent the weekend bashing my head against a wall when my PayPal IPN application mysteriously started spewing this error: Macromedia][SQLServer JDBC Driver][SQLServer]The conversion of the varchar value '242062181872839? overflowed an int column. Maximum integer value exceeded.

I couldn't understand it. I set the invoice column in the table to accept varchar(255). It has worked flawlessly for the past 3 years, and now, a new client allows PayPal to create an invoice number for them and return it in the IPN. No biggie, its been working for them as well. But on Sunday morning any invoice that was 15 chars or more long returned that error and we lost the IPN (not really, I write it first to a flat file).

So I went over to Pinal Dave's site (http://blog.sqlauthority.com) to see if I could figure anything out but nothing helped. So I opted to start a new table and give my invoice column the type numeric. We'll see how it works.

Perhaps I was sleeping in SQL class. Has anyone seen this? Could the DBA have made a change to the shared SQL server that would have caused this error?

BlogCFC was created by Raymond Camden. This blog is running version 5.9. Contact Blog Owner