coldfusion - CF queries using form variables entered by a user -

this question has answer here:

• define list of id's grouped item 1 answer

i trying query matching trans_location column form data user enters. have dropdown lets user choose multiple locations. when choose multiple places commas in between each location. when choose 1 location results come correct correct location. when choose more 1 location not find of locations. commas make 1 name , not search each location?

<cfset result = {} />  <cftry>     <cfset date1 = #createodbcdatetime(form.startdate & '00:00:00')#>     <cfset date2 = #createodbcdatetime(form.enddate & '23:59:59')#>      <cfquery datasource="#application.dsn#" name="getlocationinfo">         select *         cl_checklists         date >= #date1# , date <= #date2#         , trans_location = '#form.location#'     </cfquery>  <cfoutput>#date1#</cfoutput> <cfoutput>#date2#</cfoutput>  <cfdump var="#getlocationinfo#">      <cfcatch type="any">          <cfset result.error = cfcatch.message >          <cfset result.detail = cfcatch.detail >      </cfcatch>  </cftry> 

i tried doing this:
and trans_location = <cfqueryparam value='#form.location#' />

you need use in operator in conjunction cfqueryparam list="true" attribute. (here quick helpful tutorial cfqueryparam: https://www.petefreitag.com/item/677.cfm)

lastly: always, always, always use cfqueryparam when sending parameters database.

<cfset result = {} /> <cftry>     <cfset date1 = createodbcdatetime(form.startdate & '00:00:00')>     <cfset date2 = createodbcdatetime(form.enddate & '23:59:59')>      <cfquery datasource="#application.dsn#" name="getlocationinfo">         select  *            cl_checklists           date >=  <cfqueryparam value="#date1#" cfsqltype="cf_sql_timestamp" />                 , date <= <cfqueryparam value="#date2#" cfsqltype="cf_sql_timestamp" />                 , trans_location in ( <cfqueryparam value="#form.location#" cfsqltype="cf_sql_varchar" list="true" />  )     </cfquery>  <cfoutput>#date1#</cfoutput> <cfoutput>#date2#</cfoutput>  <cfdump var="#getlocationinfo#">      <cfcatch type="any">         <cfset result.error = cfcatch.message >         <cfset result.detail = cfcatch.detail >     </cfcatch> </cftry>