Dynamically Generating SQL Statements

As you learned in Chapter 5, Building Pages that Retrieve Data, you can retrieve a record for every employee in a database table by composing a query like this:

<CFQUERY NAME="GetEmployees" DATASOURCE="HRApp">  
    SELECT  FirstName, LastName,
    StartDate, Salary, Contract
    FROM   Employees
</CFQUERY>

But when you want to return information about employees that match user search criteria , you would add the following to an action page query:

The SQL WHERE clause to filter what is returned from a database query
The SQL LIKE operator with a wildcard string in a WHERE clause to perform pattern matching
The SQL AND clause to the WHERE clause to filter what is returned based on whether both conditions are true
A table join to filter data returned from multiple database tables
Conditional logic around AND clauses to create a flexible search interface

To see what we mean, sample this training snippet.