The use of <CFQUERYPARAM> as a means to enhance the security of ColdFusion applications (and also deliver a side benefit of improved performance) has long been advocated. But, judging by the number of sites that have been compromised by a recent spate of SQL injection attacks (that may in fact be targeting .cfm pages specifically), many have yet to apply this simple and effective enhancement.
I've discussed this subject repeatedly over the years. But, it's critical enough that I want to highlight a post I made 2 1/2 years ago entitled SQL Injection Attacks, Easy To Prevent, But Apparently Still Ignored.
where course_id = #queryParam_i(course_id)#
where the type is in the name.. _i is integer, etc. This would save 30 keystrokes with each use.