Can CFSWITCH prevent SQL injection when used for a sort column?

I use the following technique to ensure that any sort column params coming from the client go through a ListFindNoCase() function:

<cfif ListFindNoCase("date,score", params.order) EQ 0>
   <cfset params.order = "date">
</cfif>

This way, any sort column request gets vetted against the list values before being sent to the server. I then added the following code to my function:

<cfswitch expression="#params.order#">
   <cfcase value="date">
      <cfset params.order = "date DESC">
   </cfcase>
   <cfcase value="score">
  开发者_开发问答    <cfset params.order = "score ASC">
   </cfcase>
   <cfdefaultcase>
      <cfset params.order = "date DESC">
   </cfdefaultcase>
</cfswitch>

Since default case will always set order to "date DESC" if the expression does not match the first two cases, doesn't that render ListCaseNoFind() redundant?

I wanted to make sure that this is true before I removed the ListFindNoCase() function!

Sure, that is safe. You're hardcoding the order by, so there is no chance that extraneous SQL can be injected.