Summary by S. Isaac Dealey
If you work with ColdFusion, you should be aware of the CFQueryParam tag and its ability to both improve application performance and prevent SQL-injection attacks through the use of SQL bind variables. You may not be aware that SQL bind variables can be used without the CFQueryParam tag. Mark Kruger outlines the method and the madness of this technique, which can allow the use of bind variables with ColdFusion query-caching (not normally available with CFQueryparam). Data Binding Without Using CFQueryParam (Mark Kruger's blog, July 7, 2005)