you mean the cfoutput #form.search# thats open to xss attacks?

It's example code demonstrating slor functionality not on how to protect against xss. Anyone who uses example code in a production environment (e.g. cut and paste coding) deserves what he or she gets.

Perhaps a bit harsh but thats my opinion

Good one, but not it. The flaw is explicitly related to search. You are the only one who tried, so if you want, I can just spill it. :)

Ray, other than you not cleaning your url or form variable in search.cfm I don't see any other security problems. I must be losing my edge.

You know, I made this too obtuse probably. And overblown. I apologize. Really - the issue was simple. The 'old' app used logic to get PRs with a published date in the past. That logic is not respected in search. It is a classic example really of where a security/business rule in one place gets missed in another.