title: PreserveSingleQuotes and CFQueryParam
body: <p>I am building a dynamic <strong>SQL Query</strong> using <code>CFLoop</code>.
  I am using <code>CFSaveContent</code>to iterate through the variables and build the query and then I am executing it in <code>CFQuery</code> using <code>PreserveSingleQuotes</code>.
  That works fine but the issue with this method is that I can't use <code>CFQueryParam</code> so my query is vulnerable for injections.
  Is was wondering if there is any workaround for this issue?</p>
  
  <p><strong>Update:</strong></p>
  
  <pre><code>    &lt;cfsavecontent variable="sqlstring"&gt;
              SELECT   id
                      ,(CASE
                          &lt;cfloop query="qGetRules"&gt;
                              WHEN val1 &gt;=#qGetRules.equ# AND val2 &gt;#arguments.leve# THEN 1
                          &lt;/cfloop&gt;
                          ELSE 0
                           END) AS criteria
              FROM mt4_users
      &lt;/cfsavecontent&gt;
  
  
      &lt;cfquery name="qGetEquity" datasource="mydatasource"&gt;
          #PreserveSingleQuotes(variables.sqlstring)#
      &lt;/cfquery&gt;
  </code></pre>
  
  <p>So on this example as you can see I can't use <code>cfqueryparam</code> for the <code>arguments.leve</code> because it will crash on <code>PreserveSingleQuotes</code></p>