Does anyone know another way of sanitizing SQL without cfqueryparam in cfml? It's for use in the SELECT zone, and not within the WHERE conditions.

cfqueryparam works in the select zone too, generally... It's using it for table names in FROM and JOIN where it breaks down. And for that, I generally either use a whitelist of tables names to compare against, or query INFORMATION_SCHEMA.TABLES

That was exactly what I needed @Tim. Thank you so much!!!

Bear in mind that query parameters are not for "sanitising" SQL. They are for passing dynamic data values to the DB along with the SQL statement. Same as with anywhere in the SQL statement, the query parameter value is a data value and not just part of the SQL string you pass to the DB. This is likely to be relevant because you can't do this:

SELECT <cfqueryparam value="#someDynamicColumnReference#">

In the hope that you'll end up with:

SELECT some_column_name

(which I suspect is what yer trying to do). What you will end up with is:

SELECT 'some_column_name'

IE: a string literal, not a reference to a column.

Not sure if it fits exactly but using views can limit exposure