I could not make this work in CFMX8. Does anyone have any suggestions?

There’s a very nasty SQL injection attacking our sites at the moment:

DECLARE @S CHAR(4000);
SET @S=CAST(0x44…..72 AS CHAR(4000));
EXEC(@S);

You need to add DECLARE and EXEC to the regex.
I use (exec(|ute)[\s|\(]) which traps EXEC( and EXECUTE

If I change sqlregex = "select" for testing the code works fine.

The complete regular expression as listed above doesn't seem to work in CFMX8.

Dangerous Solution!

Whilst it can be useful to attempt to detect SQL injection; using detection as a defence mechanism is risky.

The only way to really be sure that no SQL injection will be possible in ColdFusion is to ensure all queries use the cfqueryparam tag around user supplied input. Additionally, all user input should be validated server side in order to ensure it matches a specific and expected data type and format.

In programming, one can always prove what is true, but not always prove what is false. Trying to protect a system by determining what user input is bad is shakey. By contrast, protecting a system by determining what user input is good is solid. Essentially, a system should only accept and process user input which adheres to an expected datatype and format. Everything else should be rejected.

Beware!

And, if I may, add TRUNCATE TABLE (or the equivalent for your DBMS)

Dont forget that DECLARE should also be in the list.