ColdFusion

In ColdFusion there is a tag called cfqueryparam that should be used whenever writing inline queries.

<cfquery name="queryTest">
SELECT FirstName, LastName, Phone
FROM   tblUser
WHERE  Status =
  <cfqueryparam cfsqltype="CF_SQL_VARCHAR" value="#form.status#">
</cfquery>

Stored procedures can be invoked with the cfstoredproc and cfprocparam tags.

Recent versions of ColdFusion provide a set of functions to run queries that have a slightly different syntax, but still provide parameterized queries.

<cfscript>
  var myQuery = new Query(sql="
    SELECT FirstName, LastName, Phone
    FROM   tblUser
    WHERE  Status = :status
  ");
  myQuery.addParam(
    name      = "status",
    value     = form.status,
    cfsqltype = "cf_sql_varchar"
  );
  var rawQuery = myQuery.execute().getResult();
</cfscript>
Fork me on GitHub