Never ever assume that a variable exists, even if you wrote the code that passes that variable (perhaps as a URL parameter or a FORM field). To be safe, use a list of tags to initialize all variables. If they do indeed exist the tag will be ignored, so no downside, and lots of upside. (Applies to:...
All SQL implementations have reserved words, words that have special meaning to the database engine. Be very careful to respect these reserved words or your app will start doing funny things when you least expect it. This includes the word "date" which must never ever be used as a column name....
Need to know the names of the columns retrieved in a database query? Simply refer to #QUERY.ColumnList# (replacing QUERY with your own query name). (Applies to: ColdFusion 3 (or later))
Any time you use a ColdFusion variable within a SQL statement, pass it with . This tag improves performance and also helps secure your SQL from potential URL tampering. (Applies to: ColdFusion 4.5 (or later))
ColdFusion Custom Tags often have to return results back to the calling code. Resist the temptation to hardcode the names of the variables that will contain these results. Instead, let the caller specify the desired variable name as a tag attribute. (Applies to: ColdFusion 3 (or later))
If your database supports the use of stored procedures (and it should), use them. Stored procedures are usually faster, they are more secure, and there are many other benefits too. (Applies to: ColdFusion All)
ColdFusion creates log files (usually in C:CFUSIONLOGS). Check these files regularly, they'll help you find problems that you'd otherwise never know of. (Applies to: ColdFusion All)
If you use make sure to specify a TIMEOUT interval. Without one the request might never time out, and sooner or later you'll run out of threads and CF will stop responding. The TIMEOUT attribute was introduced in version 4.5, so if you use , upgrade immediately. (Applies to: ColdFusion 4.5)
Client-side form field validation makes for a great user experience, but don't ever rely on it. Older browsers, connection problems, disabled browser options, and other situations could prevent your script from executing - and without script execution you have no validation. So, use client-side...
Need to time how long it takes to execute specific lines of code? You can if you use the GetTickCount() function. Add before the code, and after the code. end_time-start_time will be the execution time. (Applies to: ColdFusion 4 (or later))