Hi there

Running on SA 16.0.0.1915 using jConn4:

The Error caused by this simple thing (code is coldfusion, #...# will be replaced by it before SA sees it):

begin
   declare @now timestamp;
   set @now = current timestamp;
   update USERS
      set SESSION_KEY = hash (string(USER_GUID, '#cgi.REMOTE_ADDR#', @now), 'SHA1'),
          SESSION_KEY_IP = '#cgi.REMOTE_ADDR#',
          SESSION_KEY_ISSUED = @now,
          SESSION_KEY_TOUCHED = null
    where IS_SYSTEM_ = 0
      and USER_HASH = :uh ;

   select SESSION_KEY 
     from dba.USERS as u

       -- for next line to work it must not contain :uh again although it should!
       -- embedding the value literally does work but is not intended of course
    where USER_HASH = '#arguments.User_Hash#'  
      for read only;
end;

Note that this works where I have only ONE parameter with the same name. Set the commented WHERE clause to the same expression as above i.e. using the same parameter again, SA chokes.

Very annoying because embedding parameters literally bypasses parameter checks for all the web-related cheating like sql injection etc. etc. luckily again, having it at least for one parameter working, still prevents the script.

Hints to fix that are very welcome.

Tinu