I am trying to fix one existing dynamic select sql but the problem is its not fixing the ? placeholder, please guide if anyone knows how we can fix it here is my fiddle code https://trycf.com/gist/4d701f13db7815b1140b0267e468387c/lucee5?theme=monokai it is always ending as: select * from tablename where display_order = ? instead it should end as: select * from tablename where display_order = actual value send from the calling which could be 1 or 2 or 3

i'm a little confused by your code. the local.sqlString var inside the cfquery on line 28 would end up being evaluated as string

select * from tablename where display_order = ?

and then you execute <cfqueryparam> are you expecting the ? to get replaced by cfqueryparam? (i've never seen that kind of usage)

select * from tablename where display_order = ? <cfqueryparam>

VS

select * from tablename where display_order = <cfqueryparam>

try queryExecute( "select * from tablename where display_order = :display_order", { display_order = { value=#variable_for_display_order#, cfsqltype="INTEGER" } }, { datasource="dsn_name" } )

yes, the code is not mine,m i inherited from old code and they build this kind of functionality for using it with multiple querries, just by passing the needed parameters to aviod writting selects, so it was not working even before, so i did some debugging and found the placeholder as an issue, not not what is going on, that placeholder needs to be avaluated properly which is right now is a question mark ?

I would suggest rewriting it properly - but your other option is to wrap the whole SQL statement in a Replace() where you are changing the ? to the value of the variable. I cannot fully express what a terrible that idea is in contrast to what I sent using proper params, but it would get the job done while opening your page to sql injection and a lack of value safety with the lack of params.

that is the whole purpose, to make the select dynamic along with queryparam so there is no room for sql injection, if i do not use cfqueryparam code works well

then I suggest you use the code I suggested via the queryExecute. You can store the SQL in a variable so you can edit it as many times as you want prior to calling queryExecute while still passing in the param. it would look something like this: sql = "select * from table where display_order = :display_order" if ( some condition is true) { sql = "select * from table where display_order = :display_order and active = 1" } result = queryExecute( sql, { display_order = { value="#value#", cfsqltype="INTEGER"} }, { datasource="dsn_name" } ) that should give you the idea

i might also try assembling the where clause direct inside cfquery instead of using

local.whereClause

Inside cfloop on line 29

<cfquery name="local.result">
  #preserveSingleQuotes(local.sqlString)#
  <cfif structCount(arguments.params)>
  WHERE 
  <cfloop collection="#arguments.params#" item="key">
     #key# = <cfqueryparam value="#arguments.params[key]#" cfsqltype="#getdbSqlType(arguments.params[key])#">
  </cfloop>
  </cfif>
</cfquery>