Editing ColdFusion Markup Language (section)

== Syntax ==
CFML tags have a similar format to HTML tags. They are enclosed in [[angle brackets]] (< and >) and generally have zero or more named [[attribute (computing)|attributes]], though some tags (e.g. cfset, cfif) contain an expression rather than attributes. Many CFML tags have bodies; that is, they have beginning and end tags with text to be processed between them. For example:
<syntaxhighlight lang="cfm">
<cfoutput>
   #value# Bob!
</cfoutput> </syntaxhighlight>
Other tags, such as cfset and cfftp, never have bodies; all the required information goes between the beginning (<) character and the ending (>) character in the form of tag attributes (name/value pairs), as in the example below. If it is legal for tags not to have a body, it is syntactically acceptable to leave them unclosed as in the first example, though many CFML developers choose to self-close tags as in the second example to (arguably) make the code more legible.
<syntaxhighlight lang="cfm">
<cfset value = "Hello">
<cfset value = "Hello" />
</syntaxhighlight>
Even if the tag can have a body, including a body may not be necessary in some instances because the attributes specify all the required information. In these cases, as with the second example above, the end tag (and hence, the tag body) may be omitted and the tag may be self-closing as in the following example:<ref>[http://livedocs.adobe.com/coldfusion/6.1/htmldocs/element5.htm Tag syntax] {{webarchive |url=https://web.archive.org/web/20080527095947/http://livedocs.adobe.com/coldfusion/6.1/htmldocs/element5.htm |date=May 27, 2008}}</ref>
<syntaxhighlight lang="cfm">
<cfexecute name="C:\\winNT\\System32\\netstat.exe" arguments="-e" outputfile="C:\\Temp\\out.txt" timeout="1" /></syntaxhighlight>

Various tags offer the ability to type-check input parameters (e.g. cffunction, cfparam, cfqueryparam) if the [[programmer]] declares their type specifically. This functionality is used with cfqueryparam to [[information security|secure]] web applications and databases from [[hacker (computer security)|hacker]]s and malicious web requests such as [[SQL injection]].