CFForm vs Form in Coldfusion

Question

I have been using plain forms and input fields in coldfusion for some time now but recently discovered that cfinput tags will automagically prevent some xss attacks for me. This has made me wonder, if there is any disadvantages to using cffrom and cfinput over normal form and input tags in coldfusion.

The only disadvantage I have found in the short time looking into it is that it adds 2 external style sheets and 1 script tag to the page.

so in short:

What are the advantages and disadvantages of using CFFORM over FORM in coldfusion?

Answer 1

I prefer to write my own JS around my forms. I started out with cfform back in the day, but eventually wanted to do more robust things (validations, etc) than cfform was able to handle. That forced me to learn JS, and I've been very happy writing my own JS since.

So I guess I'd say one big drawback is that you're restricted to what cfform can handle. Depending on your situation, that might be fine.

Another drawback that I ran into a long time ago (which to be fair, may have been addressed since), is that the JS generated by cfform would conflict or interfere with my hand-written JS.

It'll certainly come down to preference. It's neither "right" nor "wrong" to use cfform or regular forms. For me, I prefer to be able to do whatever manipulation I need to do manually, as there are no restrictions/limitations.

Answer 2

I have a love-hate relationship with <cfform> & <cfinput>.

To have the same xss protection that CFFORM provides, just wrap htmlEditFormat() around value="" in regular like so:

<input name="x" value="#htmlEditFormat(x)#">

For even better XSS protection, use OWASP Enterprise Security API (.jar included in one of the CF9 latest hotfixes)

I love how I can do ajaxified form easily without writing JS, but I hate how it generates lots of ugly JavaScript and loads up lots of JS and css files for something rather simple. So I've decided to use cfform for internal sites only and not for public facing site (performance issue).

Other then the ajax features, the checked attribute that accepts CF boolean and populating select with query object are features that cfinput and cfselect provide which can be quite useful.

Use the right tool for the right job. If you found the feature of <cfform> useful, use it. Just know its limitations, and decide for yourself.