Query - String Literal Too Long ORA Error - oracle

Question

I am working in Cold Fusion 11* and I am getting the following error:
ORA-01704: string literal too long.
First off, I received this error and corrected it after looking over several sites by changing my code from:
<cfquery datasource="#dsn#">
update paragraphs
set paragraph_text = #input#
where paragraph_id=#rs_d.paragraph_id#
</cfquery>
To:
<cfquery datasource="#dsn#">
update paragraphs
set paragraph_text = <cfqueryparam cfsqltype="CF_SQL_CLOB" value=#input#>
where paragraph_id=#rs_d.paragraph_id#
</cfquery>
That fix worked perfectly. Now I am getting the same error, but instead of using cfquery, I am building the sql query into a string before working with it. So this is how the code looks:
sql = "insert into log (LOG_ENTRY_ID, program_id, paragraph_id, action, userid,";
sql = sql & " paragraph_text_old, paragraph_text_new, comment_id, current_program_status, new_program_status)";
sql = sql & " values (1 ," & program_id & ",";
if (paragraph_id neq ""){
sql = sql & paragraph_id & ",";
}
else{
sql = sql & " null,";
}
sql = sql & "'" & action & "',";
sql = sql & userid & ", '";
sql = sql & DoubleSingleQuotes(paragraph_text_old) & "','";
sql = sql & DoubleSingleQuotes(paragraph_text_new) & "',";
if (comment_id neq ""){
sql = sql & comment_id & ",";
}
else{
sql = sql & " null,";
}
if (current_program_status neq ""){
sql = sql & "'" & current_program_status & "',";
}
else{
sql = sql & " null,";
}
if (new_program_status neq ""){
sql = sql & "'" & new_program_status & "'";
}
else{
sql = sql & " null";
}
sql = sql & ")";
cfstmt(sql);
---End function
<cffunction name="cfstmt">
<cfargument name="sql">
<cfquery name="rs" datasource="#dsn#">
#PreserveSingleQuotes(sql)#
</cfquery>
</cffunction>
The cause of the error is old_paragraph_text and new_paragraph_text. I was wondering if it is possible to include a cfqueryparam type solution to this problem like in the previous problem/solution I included. I tried including it straight like the first one but I am getting compilation errors in the code. Any thoughts or tips would be helpful, thanks.

Answer 1

(Too long for comments)
wanted to limit the code so instead of determining the null value
outside the query, I added the case statements
Honestly, it does not save much, since the code is essentially doing an if/else either way. Except now the work is done on the db side, instead of the app server where it belongs.
Having worked with a lot of legacy apps, I realize they often incorporate what you might euphemistically call "questionable" code ;-) However, you should never use raw client variables in SQL. Unless you have a very good reason to do otherwise, always use cfqueryparam.
Internally, cfqueryparam uses bind variables. Two of the most important benefits are:
Bind variables help protect against sql injection, by preventing the literal values from being executed as SQL commands. This protects the database from values containing maliciously crafted SQL.
For queries executed multiple times, bind variables also boost performance by encouraging the database to reuse execution plans. Otherwise, the database may choose to generate a new execution plan when the query parameters change, which is costly.
CFQueryparam also has some other nice features, such as the "null" attribute. It can be used to submit a null value when certain conditions are met.
Finally, in terms of best practices, it is also a good idea to fully scope all variables. So for example, if the variables are submitted in the FORM scope, the final query might look something like this. (Modify the cfsqltypes as needed.)
<cfquery datasource="#variables.dsn#">
INSERT INTO into log (
program_id
, paragraph_id
, userid
, action
, paragraph_text_old
, paragraph_text_new
)
VALUES
(
<cfqueryparam value="#FORM.program_id#" cfsqltype="CF_SQL_INTEGER">
, <cfqueryparam value="#FORM.paragraph_id#" cfsqltype="CF_SQL_INTEGER" null="#NOT IsNumeric(FORM.paragraph_id)#">
, <cfqueryparam value="#Session.userid#" cfsqltype="CF_SQL_INTEGER">
, 'Paragraph Updated'
, <cfqueryparam cfsqltype="CF_SQL_CLOB" value="#rs_d.paragraph_text#">
, <cfqueryparam cfsqltype="CF_SQL_CLOB" value="#FORM.input#">
)
</cfquery>
NB: Unless a column has a different default value assigned, NULL will be inserted automatically when that column is omitted from the INSERT list.

Answer 2

I suggest re-arranging your logic to determine field null variables which then get used in the null attribute of cfqueryparam. Something like this:
<cfscript>
fieldOneNull = conditionForNull ? true : false;
fieldTwoNull = conditionForNull ? true : false;
etc
</cfscript>
<cfquery>
insert into table
(field1, field2, etc)
values
(
<cfqueryparam cfsqltype="cf_sql_whatever" value="something" null="#fieldOneNull#">
, <cfqueryparam cfsqltype="cf_sql_whatever" value="something" null="#fieldTwoNull#">
, etc
)

Answer 3

Thanks for the suggestions. Instead of modifying the existing function which is used in different areas of the application, I added a new insert statement in the position where the function was being called to deal with the clobs. To deal with the null fields I used a case statement.
<cfquery datasource="#dsn#">
insert into log (
LOG_ENTRY_ID, program_id, paragraph_id, userid, action, paragraph_text_old
, paragraph_text_new, comment_id, current_program_status, new_program_status
)
values (
null ,#program_id#,(case when #paragraph_id# = '' then null else #paragraph_id# end)
, #Session.userid# , 'Paragraph Updated'
, <cfqueryparam cfsqltype="CF_SQL_CLOB" value=#rs_d.paragraph_text#>
, <cfqueryparam cfsqltype="CF_SQL_CLOB" value=#input#>
, null, null , null
)
</cfquery>