View source for Adobe ColdFusion

{{short description|Rapid Web app development platform}}
{{About|the Adobe server platform|the programming language|CFML||Cold Fusion (disambiguation)}}
{{Infobox software
| name                   = Adobe ColdFusion
| logo                   = Adobe ColdFusion logo 2021.svg
| developer              = [[Adobe Systems]] Incorporated
| author                 = [[Joseph J. Allaire|J. J. Allaire]]
| released               = {{Start date and age|1995}}
| ver layout = stacked
| latest release version = {{Latest stable software release/Adobe ColdFusion}}
| language               = English
| genre                  = [[Application server]]
| programming language   = [[Java (programming language)|Java]]
| operating system       = [[Cross-platform]]<!--Windows, Linux, Unix, Mac OS X-->
| license                = Proprietary
| website                = {{URL|https://adobe.com/products/coldfusion-family.html}}
}}
'''Adobe ColdFusion''' is a commercial [[rapid application development|rapid web-application development]] computing platform created by [[Joseph J. Allaire|J. J. Allaire]] in 1995.<ref>
*{{cite web |url=http://infoweb.newsbank.com/resources/doc/nb/news/0EB4DAF2519867C2?p=AWNB |title=Allaire sees stellar market debut |work=Boston Herald |date=January 23, 1999 |access-date=2015-11-02 |first=Todd |last=Wallack |url-status=live |archive-url=https://archive.today/20240527143145/https://www.webcitation.org/6cjGE2X6D?url=http://infoweb.newsbank.com/resources/doc/nb/news/0EB4DAF2519867C2%3Fp=AWNB |archive-date=May 27, 2024 }}
*{{cite web|url=https://www.pcmag.com/article2/0,2817,1650251,00.asp|title=Beef up your browser|work=PC Mag|date=October 9, 2014|access-date=2015-11-02|first=Cade|last=Metz|archive-date=2015-12-22|archive-url=https://web.archive.org/web/20151222143939/http://www.pcmag.com/article2/0,2817,1650251,00.asp|url-status=live}}
*{{cite web|url=https://www.wsj.com/articles/SB886112317986989500|title=Massachusetts Rises Despite Passing of High-Tech Giants|work=Wall Street Journal|date=January 30, 1998|access-date=2015-11-02|first1=Jon|last1=Auerbach|first2=Ross|last2=Kerber|archive-date=2015-12-22|archive-url=https://web.archive.org/web/20151222132425/http://www.wsj.com/articles/SB886112317986989500|url-status=live}}
*{{cite web|url=http://coldfusion.adobe.com/coldfusion/TurningUpTheHeat.pdf|title=Turning Up the Heat on Mobile Application Development with ColdFusion 11|work=IDC White Paper|date=January 2015|access-date=2015-11-02|first=Al|last=Hilwa|archive-date=2015-09-16|archive-url=https://web.archive.org/web/20150916111733/http://coldfusion.adobe.com/coldfusion/TurningUpTheHeat.pdf|url-status=live}}</ref> (The [[programming language]] used with that platform is also commonly called ColdFusion, though is more accurately known as [[CFML]].) ColdFusion was originally designed to make it easier to connect simple [[HTML]] pages to a [[database]]. By version 2 (1996) it had become a full platform that included an [[Integrated development environment|IDE]] in addition to a full [[scripting language]].

== Overview ==
One of the distinguishing features of ColdFusion is its associated scripting language, [[ColdFusion Markup Language]] (CFML). CFML compares to the scripting components of [[Active Server Pages|ASP]], [[JavaServer Pages|JSP]], and [[PHP]] in purpose and features, but its tag syntax more closely resembles [[HTML]], while its script syntax resembles [[JavaScript]]. ''ColdFusion'' is often used synonymously with ''[[ColdFusion Markup Language|CFML]]'', but there are [[#Alternative server environments|additional CFML application servers]] besides ColdFusion, and ColdFusion supports programming languages other than CFML, such as server-side [[Actionscript]] and embedded scripts that can be written in a [[JavaScript]]-like language known as [[CFScript]].

Originally a product of [[Allaire Corporation|Allaire]] and released on July 2, 1995, ColdFusion was developed by brothers [[Joseph J. Allaire]] and [[Jeremy Allaire]]. In 2001 [[Allaire Corporation|Allaire]] was acquired by [[Macromedia]], which in turn was acquired by [[Adobe Systems]] Inc in 2005.

ColdFusion is most often used for data-driven [[website]]s or [[intranet]]s, but can also be used to generate remote services such as [[REST]] services, [[WebSocket]]s, [[SOAP]] [[web service]]s or [[Adobe Flash|Flash]] remoting. It is especially well-suited as the server-side technology to the client-side [[ajax (programming)|ajax]].

ColdFusion can also handle asynchronous events such as [[Short message service|SMS]] and [[instant messaging]] via its gateway interface, available in ColdFusion MX 7 Enterprise Edition.

=== Main features ===
ColdFusion provides a number of additional features out of the box. Main features include:
* Simplified database access
* Client and server cache management
* Client-side code generation, especially for form [[Widget (computing)|widgets]] and validation
* Conversion from [[HyperText Markup Language|HTML]] to [[Portable Document Format|PDF]]
* Data retrieval from common enterprise systems such as [[Active Directory]], [[Lightweight Directory Access Protocol|LDAP]], [[Simple Mail Transfer Protocol|SMTP]], [[Post Office Protocol|POP]], [[HyperText Transfer Protocol|HTTP]], [[File Transfer Protocol|FTP]], [[Microsoft Exchange Server]] and common data formats such as [[RSS]] and [[Atom (standard)|Atom]]
* File [[Index (database)|indexing]] and searching service based on [[Apache Solr]]
* [[Graphical user interface|GUI]] administration
* Server, application, client, session, and request [[Scope (programming)|scopes]]
* [[XML]] parsing, [[XPath|querying (XPath)]], validation and [[XSLT|transformation (XSLT)]]
* Server clustering
* Task scheduling
* [[Chart|Graphing]] and [[Financial reporting|reporting]]
* Simplified file manipulation including [[raster graphics]] (and [[CAPTCHA]]) and [[ZIP (file format)|zip archives]] (introduction of video manipulation is planned in a future release)
* Simplified [[web service]] implementation (with automated [[Web services description language|WSDL]] generation / transparent [[SOAP (protocol)|SOAP]] handling for both creating and consuming services - as an example, [[ASP.NET]]<ref>[http://digitalcolony.com/2007/08/consuming-web-service-in-aspnet.aspx Consuming a Web Service in ASP.NET Tutorial] {{webarchive |url=https://web.archive.org/web/20081223084910/http://digitalcolony.com/2007/08/consuming-web-service-in-aspnet.aspx |date=December 23, 2008 }}. Digital Colony (2007-08-23). Retrieved on 2013-07-21.</ref> has no native equivalent for <syntaxhighlight lang="cfm" inline><CFINVOKE WEBSERVICE="http://host/tempconf.cfc?wsdl" METHOD="Celsius2Fahrenheit" TEMP="#tempc#" RETURNVARIABLE="tempf"></syntaxhighlight><ref>[https://www.adobe.com/devnet/coldfusion/articles/cf_aspnet08.html] {{webarchive|url=https://web.archive.org/web/20060720165335/https://www.adobe.com/devnet/coldfusion/articles/cf_aspnet08.html|date=July 20, 2006}}</ref>)

Other implementations of CFML offer similar or enhanced functionality, such as running in a [[.NET Framework|.NET]] environment or image manipulation.

The engine was written in C and featured, among other things, a built-in scripting language (CFScript), plugin modules written in Java, and a syntax very similar to HTML. The equivalent to an HTML element, a ColdFusion tag begins with the letters "CF" followed by a name that is indicative of what the tag is interpreted to, in HTML. E.g. &lt;cfoutput&gt; to begin the output of variables or other content.

In addition to CFScript and plugins (as described), CFStudio provided a design platform with a [[WYSIWYG]] display. In addition to ColdFusion, CFStudio also supports syntax in other languages popular for backend programming, such as Perl. In addition to making backend functionality easily available to the non-programmer, (version 4.0 and forward in particular) integrated easily with the [[Apache HTTP Server|Apache Web Server]] and with [[Internet Information Services]].

=== Other features ===
All versions of ColdFusion prior to 6.0 were written using Microsoft [[Visual C++]]. This meant that ColdFusion was largely limited to running on [[Microsoft Windows]], although Allaire did successfully port ColdFusion to [[Sun Microsystems|Sun]] [[Solaris (operating system)|Solaris]] starting with version 3.1.

The [[Allaire Corporation|Allaire]] company was sold to [[Macromedia]], then Macromedia was sold to [[Adobe Systems|Adobe]]. Earlier versions were not as robust as the versions available from version 4.0 forward.{{Fact or opinion|date=June 2019}}

With the release of ColdFusion MX 6.0, the engine had been re-written in [[Java (programming language)|Java]] and supported its own runtime environment, which was easily replaced through its configuration options with the runtime environment from Sun. Version 6.1 included the ability to code and debug [[Adobe Flash|Macromedia Flash]].

== Versions ==

=== Cold Fusion 3 ===
Version 3, released in June 1997, brought custom tags, cfsearch/cfindex/cfcollection based on the Verity search engine, the server scope, and template encoding (called then "encryption"). Version 3.1, released in Jan 1998, added RDS support as well as a port to the [[Solaris (operating system)|Sun Solaris]] operating system, while ColdFusion studio gained a live page preview and HTML syntax checker.

=== ColdFusion 4 ===
Released in Nov 1998, version 4 is when the name was changed from "Cold Fusion" to "ColdFusion" - possibly to distinguish it from [[Cold fusion]] theory. The release also added the initial implementation of cfscript, support for locking (cflock), transactions (cftransaction), hierarchical exception handling (cftry/cfcatch), sandbox security, as well as many new tags and functions, including cfstoredproc, cfcache, cfswitch, and more.

=== ColdFusion 4.5 ===
Version 4.5, released in Nov 1999, expanded the ability to access external system resources, including COM and CORBA, and added initial support for Java integration (including EJB's, Pojo's, servlets, and Java CFX's). IT also added the getmetricdata function (to access performance information), additional performance information in page debugging output, enhanced string conversion functions, and optional whitespace removal.

=== ColdFusion 5 ===
Version 5 was released in June 2001, adding enhanced query support, new reporting and charting features, user-defined functions, and improved admin tools. It was the last to be legacy coded for a specific platform, and the first release from [[Macromedia]] after their acquisition of [[Allaire Corporation]], which had been announced January 16, 2001.

=== ColdFusion MX 6 ===
Prior to 2000, Edwin Smith, an Allaire architect on JRun and later the [[Flash Player]], Tom Harwood and Clement Wong initiated a project codenamed "Neo".<ref>{{Cite web |url=http://video.google.com/videoplay?docid=9025154931505227826 |title=ColdFusion's 10th Birthday Party |access-date=2011-09-29 |archive-date=2011-10-11 |archive-url=https://web.archive.org/web/20111011175737/http://video.google.com/videoplay?docid=9025154931505227826 |url-status=live }}</ref> This project was later revealed as a ColdFusion Server re-written completely using [[Java platform|Java]]. This made portability easier and provided a layer of security on the server, because it ran inside a Java Runtime Environment.

In June 2002 Macromedia released the version 6.0 product under a slightly different name, ColdFusion MX, allowing the product to be associated with both the Macromedia brand and its original branding. ColdFusion MX was completely rebuilt from the ground up and was based on the [[Java EE]] platform. ColdFusion MX was also designed to integrate well with Macromedia Flash using Flash Remoting.

With the release of ColdFusion MX, the CFML language API was released with an [[Object-oriented programming|OOP]] interface.

=== ColdFusion MX 7 ===
With the release of ColdFusion 7.0 on February 7, 2005, the naming convention was amended, rendering the product name "Macromedia ColdFusion MX 7" (the codename for CFMX7 was "Blackstone"). CFMX 7 added Flash-based and [[XForms]]-based web forms, and a report builder that output in [[Adobe PDF]] as well as [[FlashPaper]], [[Rich Text Format|RTF]] and [[Microsoft Excel|Excel]]. The Adobe PDF output is also available as a wrapper to any HTML page, converting that page to a quality printable document. The enterprise edition also added [[Gateway (computer networking)|Gateways]]. These provide interaction with non-HTTP request services such as IM Services, SMS, Directory Watchers, and an asynchronous execution. XML support was boosted in this version to include native schema checking.

ColdFusion MX 7.0.1 (codename "Merrimack") added support for [[macOS|Mac OS X]], improvements to Flash forms, RTF support for CFReport, the new CFCPRoxy feature for Java/CFC integration, and more. ColdFusion MX 7.0.2 (codenamed "Mystic") included advanced features for working with Adobe Flex 2 as well as more improvements for the CF Report Builder.

=== Adobe ColdFusion 8 ===
On July 30, 2007, [[Adobe Systems]] released '''ColdFusion 8''', dropping "MX" from its name.<ref>{{cite web
  | title = Adobe Ships ColdFusion 8
  | work = Adobe Systems Incorporated
  | date = 2007-07-30
  | url = https://www.adobe.com/aboutadobe/pressroom/pressreleases/200707/073007ColdFusion.html
  | access-date = 2014-08-20
  | archive-date = 2015-10-26
  | archive-url = https://web.archive.org/web/20151026105451/http://www.adobe.com/aboutadobe/pressroom/pressreleases/200707/073007ColdFusion.html
  | url-status = live
  }}</ref> During beta testing the codename used was "Scorpio" (the eighth sign of the zodiac and the eighth iteration of ColdFusion as a commercial product). More than 14,000 developers worldwide were active in the beta process - many more testers than the 5,000 [[Adobe Systems]] originally expected. The ColdFusion development team consisted of developers based in Newton/Boston, Massachusetts and offshore in Bangalore, India.

Some of the new features are the CFPDFFORM tag, which enables integration with [[Adobe Acrobat]] forms, some image manipulation functions, [[Microsoft .NET]] integration, and the CFPRESENTATION tag, which allows the creation of dynamic presentations using [[Adobe Acrobat Connect]], the Web-based collaboration solution formerly known as [[Macromedia Breeze]]. In addition, the ColdFusion Administrator for the Enterprise version ships with built-in server monitoring. ColdFusion 8 is available on several [[operating systems]] including [[Linux]], Mac OS X and [[Windows Server 2003]].

Other additions to ColdFusion 8 are built-in [[Ajax (programming)|Ajax]] widgets, file archive manipulation (CFZIP), [[Microsoft Exchange Server|Microsoft Exchange server]] integration (CFEXCHANGE), image manipulation including automatic [[CAPTCHA]] generation (CFIMAGE), multi-threading, per-application settings, [[Atom (standard)|Atom]] and [[RSS]] feeds, reporting enhancements, stronger encryption libraries, array and structure improvements, improved database interaction, extensive performance improvements, PDF manipulation and merging capabilities (CFPDF), interactive debugging, embedded database support with [[Apache Derby]], and a more [[ECMAScript]] compliant CFSCRIPT.

For development of ColdFusion applications, several tools are available: primarily [[Adobe Dreamweaver]] CS4, [[Macromedia HomeSite]] 5.x, CFEclipse, [[Eclipse (software)|Eclipse]] and others. "Tag updaters" are available for these applications to update their support for the new ColdFusion 8 features.

=== Adobe ColdFusion 9 ===
ColdFusion 9 (Codenamed: [[Centaur]]) was released on October 5, 2009. New features for CF9 include:
* Ability to code ColdFusion Components (CFCs) entirely in CFScript.
* An explicit "local" scope that does not require local variables to be declared at the top of the function.
* Implicit getters/setters for CFC.
* Implicit constructors via method called "init" or method with same name as CFC.
* New CFFinally tag for [[Exception handling syntax]] and CFContinue tag for [[Control flow]].
* [[Object-relational mapping]] (ORM) Database integration through [[Hibernate (Java)]].
* Server.cfc file with onServerStart and onServerEnd methods.
* Tighter integration with [[Adobe Flex]] and [[Adobe AIR]].
* Integration with key Microsoft products including Word, Excel, SharePoint, Exchange, and PowerPoint.
* In Memory Management - or Virtual File System: an ability to treat content in memory as opposed to using the HDD.
* Exposed as Services - an ability to access, securely, functions of the server externally.

=== Adobe ColdFusion 10 ===
ColdFusion 10 (Codenamed: Zeus) was released on May 15, 2012. New or improved features available in all editions (Standard, Enterprise, and Developer) include (but are not limited to):
* Security enhancements
* Hotfix installer and notification
* Improved scheduler (based on a version of quartz)
* Improved web services support (WSDL 2.0, SOAP 1.2)
* Support for [[HTML5]] web sockets
* [[Apache Tomcat|Tomcat]] integration
* Support for RESTful web services
* Language enhancements (closures, and more)
* Search integration with Apache Solr
* HTML5 video player and Adobe Flash Player
* Flex and Adobe AIR lazy loading
* XPath integration
* HTML5 enhancements

Additional new or improved features in ColdFusion Enterprise or Developer editions include (but are not limited to):
* Dynamic and interactive HTML5 charting
* Improved and revamped scheduler (additional features over what is added in CF10 Standard)
* Object relational mapping enhancements

The lists above were obtained from the Adobe web site pages describing "new features", as listed first in the links in the following list.

CF10 was originally referred to by the codename Zeus, after first being confirmed as coming by Adobe at [[Adobe MAX]] 2010, and during much of its prerelease period. It was also commonly referred to as "ColdFusion next" and "ColdFusion X" in blogs, on Twitter, etc., before Adobe finally confirmed it would be "ColdFusion 10". For much of 2010, ColdFusion Product Manager Adam Lehman toured the US setting up countless meetings with customers, developers, and user groups to formulate a master blueprint for the next feature set. In September 2010, he presented the plans to Adobe where they were given full support and approval by upper management.<ref>{{cite web|url=http://adrocknaphobia.com/post.cfm/the-modern-age-of-coldfusion |title=Adrocknaphobia - "The Modern age of ColdFusion" |access-date=2012-12-28 |url-status=dead |archive-url=https://web.archive.org/web/20110615031308/http://adrocknaphobia.com/post.cfm/the-modern-age-of-coldfusion |archive-date=2011-06-15 }}</ref>

The first public beta of ColdFusion 10 was released via Adobe Labs on 17 February 2012.

=== Adobe ColdFusion 11 ===

ColdFusion 11 (Codenamed: Splendor) was released on April 29, 2014.

New or improved features available in all editions (Standard, Enterprise, and Developer) include:
* End-to-end mobile development
* A new lightweight edition (ColdFusion Express)
* Language enhancements
* WebSocket enhancements
* PDF generation enhancements
* Security enhancements
* Social enhancements
* REST enhancements
* Charting enhancements
* Compression enhancements

ColdFusion 11 also removed many features previously identified simply as "deprecated" or no longer supported in earlier releases. For example, the CFLOG tag long offered date and time attributes which were deprecated (and redundant, as the date and time is always logged). As of CF11, their use would not cause the CFLOG tag to fail.

=== Adobe ColdFusion (2016 Release) ===

Adobe ColdFusion (2016 release), Codenamed: Raijin (and also known generically as ColdFusion 2016) was released on February 16, 2016.

New or improved features available in all editions (Standard, Enterprise, and Developer) include:
* Language enhancements
* Command Line Interface (CLI)
* PDF generation enhancements
* Security enhancements
* External session storage (Redis)
* Swagger document generation
* NTLM support
* API Manager

=== Adobe ColdFusion (2018 Release) ===
Adobe ColdFusion (2018 release), known generically as ColdFusion 2018, was released on July 12, 2018.<ref>{{cite web
  |url=https://coldfusion.adobe.com/2018/07/new-coldfusion-release-adds-performance-monitoring-toolset-for-measuring-monitoring-and-managing-high-performing-web-apps/
  |title=New ColdFusion Release Adds Performance Monitoring Toolset for Measuring, Monitoring and Managing High-Performing Web Apps
  |date=2018-07-12
  |work=Adobe Systems Incorporated
  |access-date=2018-07-16
  |archive-date=2018-07-16
  |archive-url=https://web.archive.org/web/20180716112048/https://coldfusion.adobe.com/2018/07/new-coldfusion-release-adds-performance-monitoring-toolset-for-measuring-monitoring-and-managing-high-performing-web-apps/
  |url-status=live
  }}</ref> ColdFusion 2018 was codenamed Aether during prerelease.<ref name=":0">{{cite web|url=http://blogs.coldfusion.com/post.cfm/code-names-for-coldfusion-server-and-coldfusion-builder|title=Code names for ColdFusion server and ColdFusion Builder|work=Adobe ColdFusion Blog|access-date=2015-08-05|archive-date=2015-07-10|archive-url=https://web.archive.org/web/20150710045415/http://blogs.coldfusion.com/post.cfm/code-names-for-coldfusion-server-and-coldfusion-builder|url-status=dead}}</ref>

As of March 2023, Adobe had released 16 updates<ref>{{Cite web|url=https://helpx.adobe.com/in/coldfusion/kb/coldfusion-2018-updates.html|title=ColdFusion (2018 release) updates|website=helpx.adobe.com|access-date=2019-10-09}}</ref> for ColdFusion 2018.

New or improved features available in all editions (Standard, Enterprise, and Developer) include:<ref>{{cite web
  |url= https://www.adobe.com/products/coldfusion-standard/features.html
  |title= ColdFusion 2018 Features
  |work= Adobe Systems Incorporated
  |access-date= 2018-07-27
  |archive-date= 2018-07-28
  |archive-url= https://web.archive.org/web/20180728035709/https://www.adobe.com/products/coldfusion-standard/features.html
  |url-status= live
  }}</ref>
* Language enhancements (including NULL, abstract classes and methods, covariants and finals, closures in tags, and more)
* Asynchronous programming, using Futures
* Command line REPL
* Auto lockdown capability
* Distributed cache support (Redis, memcached, JCS)
* REST playground capability
* Modernized Admin UI
* Performance Monitoring Toolset

===  Adobe ColdFusion (2021 Release) ===
Adobe ColdFusion (2021 Release) was released on Nov 11th, 2020. ColdFusion 2021 was code named Project Stratus during pre-release.

New or improved features available in all editions (Standard, Enterprise, and Developer) include:

* Lightweight installer
* ColdFusion Package Manager
* [[Cloud storage service]]s
* Messaging services
* No-SQL database
* Single sign-on
* Core language changes
* Performance Monitoring Tool set

===  Adobe ColdFusion (2023 Release) ===

Adobe released ColdFusion 2023 on May 17, 2023. ColdFusion 2023 was code named Project Fortuna during pre-release.

New features available are as follows: <ref>{{cite web
  |url= https://helpx.adobe.com/coldfusion/using/whats-new.html
  |title= ColdFusion 2023 Features
  |work= Adobe Systems Incorporated
  |access-date= 2023-11-17
  |archive-date= 2023-11-17
  |archive-url= https://web.archive.org/web/20231117165558/https://helpx.adobe.com/coldfusion/using/whats-new.html
  |url-status= live
  }}</ref>

* Google Cloud Platform (GCP) - Storage, Pub/Sub, FireStore
* Central Configuration Server (CCS)
* SSO CF Admin Integration (SAML/LDAP) including CF Admin API updates
* JSON Web Tokens
* Avro & Protocol Buffer Serialization
* New PDF Engine
* Library Updates (Java, Solr, Hibernate)
* Native GraphQL Query support
* Bug fixes

===  Adobe ColdFusion (2025 Release) ===

Adobe released ColdFusion 2025 on February 25, 2025. ColdFusion 2025 was referred to simply as "cfnext" during pre-release.

== Development roadmap ==
In Sep 2017, Adobe announced the roadmap anticipating releases in 2018 and 2020.<ref>{{cite web |title=ColdFusion - Transformation over the years |url=http://wwwimages.adobe.com/content/dam/acom/en/products/coldfusion/pdfs/cf2016/Roadmap_for_Adobe_ColdFusion.pdf |publisher=[[Adobe Inc.|Adobe]] |archive-url=https://web.archive.org/web/20220309102348/http://wwwimages.adobe.com/content/dam/acom/en/products/coldfusion/pdfs/cf2016/Roadmap_for_Adobe_ColdFusion.pdf |archive-date=9 March 2022|url-status=dead}}</ref> Among the key features anticipated for the 2016 release were a new performance monitor, enhancements to asynchronous programming, revamped REST support, and enhancements to the API Manager, as well as support for CF2016 projected into 2024. As for the 2020 release, the features anticipated at that time (in 2017) were configurability (modularity) of CF application services, revamped scripting and object-oriented support, and further enhancements to the API Manager.

== Features ==

=== PDF generation ===
ColdFusion can generate [[PDF]] documents using standard HTML (i.e. no additional coding is needed to generate documents for print). CFML authors place HTML and CSS within a pair of cfdocument tags (or new in ColdFusion 11, cfhtmltopdf tags). The generated document can then either be saved to disk or sent to the client's browser. ColdFusion 8 introduced also the cfpdf tag to allow for control over PDF documents including PDF forms, and merging of PDFs. These tags however do not use Adobe's PDF engine but cfdocument uses a combination of the commercial JPedal Java PDF library and the free and open source Java library [[iText]]. The library used by cfhtmltopdf since cf11 has been an embedded [[WebKit]] IMPLEMENTATION.<ref>{{cite web|url=https://helpx.adobe.com/coldfusion/pdf-generation-in-coldfusion.html|title=PDF Generation in ColdFusion|publisher=Adobe|access-date=2017-01-27|archive-date=2017-07-09|archive-url=https://web.archive.org/web/20170709195908/https://helpx.adobe.com/coldfusion/pdf-generation-in-coldfusion.html|url-status=live}}</ref> Since cf2023, Adobe has licensed PDFReactor to be the default engine underlying cfhtmltopdf.

=== ColdFusion Components (Objects) ===
ColdFusion was originally not an [[object-oriented programming language]] like [[PHP]] versions 3 and below. ColdFusion falls into the category of OO languages that do not support [[multiple inheritance]] (along with Java, Smalltalk, etc.).<ref>{{cite web|url=http://www.nictunney.com/index.cfm?mode=entry&entry=AE4A4A21-65B8-F252-775A757FC01D0C30|title=Ramblings of an Internet MoFo|access-date=2008-04-16|archive-date=2008-12-20|archive-url=https://web.archive.org/web/20081220071809/http://www.nictunney.com/index.cfm?mode=entry&entry=AE4A4A21-65B8-F252-775A757FC01D0C30|url-status=live}}</ref> With the MX release (6+), ColdFusion introduced basic OO functionality with the ''component'' language construct which resembles classes in OO languages. Each ''component'' may contain any number of properties and methods. One component may also extend another ([[Inheritance (object-oriented programming)|Inheritance]]). Components only support single inheritance. Object handling feature set and performance enhancing has occurred with subsequent releases. With the release of ColdFusion 8, Java-style [[interface (programming)|interfaces]] are supported. ColdFusion components use the file extension ''cfc'' to differentiate them from ColdFusion templates (.cfm).

==== Remoting ====
Component methods may be made available as web services with no additional coding and configuration. All that is required is for a method's access to be declared 'remote'. ColdFusion automatically generates a [[Web Services Description Language|WSDL]] at the URL for the component in this manner: <nowiki>http://path/to/components/Component.cfc?wsdl</nowiki>. Aside from SOAP, the services are offered in Flash Remoting binary format.

Methods which are declared remote may also be invoked via an HTTP GET or POST request. Consider the GET request as shown.
<br />
 <nowiki>http://path/to/components/Component.cfc?method=search&query=your+query&mode=strict</nowiki>
This will invoke the component's search function, passing "your query" and "strict" as arguments.

This type of invocation is well-suited for [[Ajax (programming)|Ajax]]-enabled applications. ColdFusion 8 introduced the ability to serialize ColdFusion data structures to [[JSON]] for consumption on the client.

The ColdFusion server will automatically generate documentation for a component if you navigate to its URL and insert the appropriate code within the component's declarations. This is an application of component introspection, available to developers of ColdFusion components. Access to a component's documentation requires a password. A developer can view the documentation for all components known to the ColdFusion server by navigating to the ColdFusion URL. This interface resembles the [[Javadoc]] HTML documentation for Java classes.

=== Custom Tags ===
ColdFusion provides several ways to implement custom [[markup language]] tags, i.e. those not included in the core ColdFusion language. These are especially useful for providing a familiar interface for web designers and content authors familiar with HTML but not [[imperative programming]].

The traditional and most common way is using CFML. A standard CFML page can be interpreted as a tag, with the tag name corresponding to the file name prefixed with "cf_". For example, the file IMAP.cfm can be used as the tag "cf_imap". Attributes used within the tag are available in the ATTRIBUTES scope of the tag implementation page. CFML pages are accessible in the same directory as the calling page, via a special directory in the ColdFusion web application, or via a CFIMPORT tag in the calling page. The latter method does not necessarily require the "cf_" prefix for the tag name.

A second way is the developments of CFX tags using Java or C++. CFX tags are prefixed with "cfx_", for example "cfx_imap". Tags are added to the ColdFusion runtime environment using the ColdFusion administrator, where JAR or DLL files are registered as custom tags.

Finally, ColdFusion supports JSP tag libraries from the JSP 2.0 language specification. JSP tags are included in CFML pages using the CFIMPORT tag.

== Interactions with other programming languages ==

=== ColdFusion and Java ===
The standard ColdFusion installation allows the deployment of ColdFusion as a [[WAR (Sun file format)|WAR file]] or [[EAR (file format)|EAR file]] for deployment to standalone application servers, such as [[Macromedia JRun]], and IBM [[WebSphere]]. ColdFusion can also be deployed to servlet containers such as [[Apache Tomcat]] and [[Jetty (web server)|Mortbay Jetty]], but because these platforms do not officially support ColdFusion, they leave many of its features inaccessible. As of ColdFusion 10 [[Macromedia JRun]] was replaced by [[Apache Tomcat]].

Because ColdFusion is a Java EE application, ColdFusion code can be mixed with Java classes to create a variety of applications and use existing Java libraries. ColdFusion has access to all underlying Java classes, supports JSP custom tag libraries, and can access JSP functions after retrieving the JSP page context (''GetPageContext()'').

Prior to ColdFusion 7.0.1, ColdFusion components could only be used by Java or .NET by declaring them as web services. However, beginning in ColdFusion MX 7.0.1, ColdFusion components can now be used directly within Java classes using the CFCProxy class.<ref>{{cite web|url=http://www.forta.com/misc/cfcproxy.htm|title=Using the CFC Proxy|access-date=2005-12-25|archive-url=https://web.archive.org/web/20051226115144/http://www.forta.com/misc/cfcproxy.htm|archive-date=2005-12-26|url-status=dead}}</ref>

Recently, there has been much interest in Java development using alternate languages such as [[Jython]], [[Groovy (programming language)|Groovy]] and [[JRuby]]. ColdFusion was one of the first scripting platforms to allow this style of Java development.

=== ColdFusion and .NET ===
ColdFusion 8 natively supports [[.NET Framework|.NET]] within the CFML syntax. ColdFusion developers can simply call any .NET assembly without needing to recompile or alter the assemblies in any way. Data types are automatically translated between ColdFusion and .NET (example: .NET DataTable → ColdFusion Query).

A unique feature for a Java EE vendor, ColdFusion 8 offers the ability to access .NET Assemblies remotely through proxy (without the use of [[.NET Remoting]]). This allows ColdFusion users to leverage .NET without having to be installed on a Windows operating system.

== Abbreviations ==
{{anchor|Acronyms}}
The [[initialism]] for the ColdFusion Markup Language is ''CFML''. When ColdFusion templates are saved to disk, they are traditionally given the extension .cfm or .cfml. The .cfc extension is used for ColdFusion Components. The original extension was DBM or DBML, which stood for Database Markup Language. When talking about ColdFusion, most users use the acronym CF and this is used for numerous ColdFusion resources such as user groups (CFUGs) and sites.

CFMX is the common abbreviation for ColdFusion versions 6 and 7 (a.k.a. ColdFusion MX).

== Alternative server environments ==
ColdFusion originated as proprietary technology based on Web technology industry standards. However, it is becoming a less closed technology through the availability of competing products. Such alternative products include :

* [[Lucee]] - Free, open source CFML engine forked from Railo. Lucee's aim is to provide the functionality of CFML using less resources and giving better performance and to move CFML past its roots and into a modern and dynamic web programming platform. Lucee is backed by community supporters and members of the Lucee Association.
These are discontinued or down :
* BlueDragon - Proprietary .NET-based CFML engine and free open source Java-based CFML engine (Open BlueDragon).
* Coral Web Builder
* IgniteFusion
* OpenBD - The open source version of BlueDragon was released as Open BlueDragon (OpenBD) in December 2008.
* [[Railo]] - Free, open source CFML engine. It comes in three main product editions, and other versions.
* SmithProject

The argument can be made that ColdFusion is even less platform-bound than raw Java EE or .NET, simply because ColdFusion will run on top of a .NET app server (New Atlanta), or on top of any servlet container or Java EE application server ([[JRun]], [[IBM WebSphere Application Server|WebSphere]], [[JBoss]], [[Apache Geronimo|Geronimo]], [[Apache Tomcat|Tomcat]], [[Resin Server]], [[Jetty (web server)]], etc.). In theory, a ColdFusion application could be moved unchanged from a Java EE application server to a .NET application server.

== Vulnerabilities ==
In March 2013, a known issue affecting ColdFusion 8, 9 and 10 left the [[National Vulnerability Database]] open to attack.<ref>{{cite web|last=Clark|first=Jack|url=https://www.theregister.co.uk/2013/03/14/adobe_coldfusion_vulns_compromise_us_malware_catalog/|title=Downed US vuln catalog infected for at least TWO MONTHS|work=The Register|date=2013-03-14|access-date=2017-08-23|archive-date=2017-07-03|archive-url=https://web.archive.org/web/20170703051740/https://www.theregister.co.uk/2013/03/14/adobe_coldfusion_vulns_compromise_us_malware_catalog/|url-status=live}}</ref> The vulnerability had been identified and a patch released by Adobe for CF9 and CF10 in January.<ref>[https://www.adobe.com/support/security/advisories/apsa13-01.html Security Advisories: APSA13-01 - Security Advisory for ColdFusion] {{Webarchive|url=https://web.archive.org/web/20140714135439/http://www.adobe.com/support/security/advisories/apsa13-01.html |date=2014-07-14 }}. Adobe. Retrieved on 2013-07-21.</ref>

In April 2013, a ColdFusion vulnerability was blamed by [[Linode]] for an intrusion into the Linode Manager control panel website.<ref>{{cite web|url=http://blog.linode.com/2013/04/16/security-incident-update/|title=Linode Blog » Security incident update|date=16 April 2013|access-date=16 April 2013|archive-date=19 April 2013|archive-url=https://web.archive.org/web/20130419011001/http://blog.linode.com/2013/04/16/security-incident-update/|url-status=live}}</ref> A security bulletin and [[hotfix]] for this had been issued by Adobe a week earlier.<ref>[https://www.adobe.com/support/security/bulletins/apsb13-10.html Adobe – Security Bulletins: APSB13-10 – Security update: Hotfix available for ColdFusion] {{Webarchive|url=https://web.archive.org/web/20140816182041/http://www.adobe.com/support/security/bulletins/apsb13-10.html |date=2014-08-16 }}. Adobe.com. Retrieved on 2013-07-21.</ref>

In May 2013, Adobe identified another critical vulnerability, reportedly already being exploited in the wild, which targets all recent versions of ColdFusion on any servers where the web-based administrator and API have not been locked down. The vulnerability allows unauthorized users to upload malicious scripts and potentially gain full control over the server.<ref>*[http://blog.edgewebhosting.net/2013/05/0-day-exploit-for-coldfusion/ 0-Day Exploit for ColdFusion | Edge Web HostingEdge Web Hosting] {{Webarchive|url=https://archive.today/20130703053802/http://blog.edgewebhosting.net/2013/05/0-day-exploit-for-coldfusion/ |date=2013-07-03 }}. Blog.edgewebhosting.net (2013-05-08). Retrieved on 2013-07-21.
*{{cite web|url=https://www.adobe.com/support/security/advisories/apsa13-03.html|title=Adobe - Security Advisories: APSA13-03 - Security Advisory for ColdFusion|access-date=2014-08-20|archive-date=2014-08-17|archive-url=https://web.archive.org/web/20140817114011/http://www.adobe.com/support/security/advisories/apsa13-03.html|url-status=live}}</ref> A security bulletin and [[hotfix]] for this was issued by Adobe 6 days later.<ref>{{cite web|url=https://www.adobe.com/support/security/bulletins/apsb13-13.html|title=Adobe - Security Bulletins: APSB13-13 - Security update: Hotfix available for ColdFusion|access-date=2014-08-30|archive-date=2014-09-01|archive-url=https://web.archive.org/web/20140901064202/http://www.adobe.com/support/security/bulletins/apsb13-13.html|url-status=live}}</ref>

In April 2015, Adobe fixed a [[cross-site scripting]] (XSS) vulnerability<ref>{{Cite news|url=https://www.zerodaynews.tech/2019/09/adobe-unscheduled-update-fixes-critical.html|title=Adobe Unscheduled Update Fixes Critical ColdFusion Flaws(CVE-2019-8072)|archive-date=2019-09-28|access-date=2019-09-28|archive-url=https://web.archive.org/web/20190928011140/https://www.zerodaynews.tech/2019/09/adobe-unscheduled-update-fixes-critical.html|url-status=live}}</ref>
in Adobe ColdFusion 10 before Update 16, and in ColdFusion 11 before Update 5,
that allowed remote attackers to inject arbitrary web script or HTML;<ref>{{cite web|url=https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0345|title=National Cyber Awareness System: Vulnerability Summary for CVE-2015-0345|author=NIST National Vulnerability Database|access-date=2015-08-31}}</ref> however, it's exploitable only by users who have authenticated through the administration panel.
<ref>{{cite web|url=http://www.bishopfox.com/blog/2015/08/coldfusion-bomb-a-chain-reaction-from-xss-to-rce/|title=ColdFusion Bomb: A Chain Reaction From XSS to RCE|author=Shubham Shah|access-date=2015-08-31|archive-date=2015-08-28|archive-url=https://web.archive.org/web/20150828005149/http://www.bishopfox.com/blog/2015/08/coldfusion-bomb-a-chain-reaction-from-xss-to-rce/|url-status=live}}</ref>

In September 2019, Adobe fixed two command injection vulnerabilities (CVE-2019-8073<ref>{{cite web |title=CVE-2019-8073 Detail |url=https://nvd.nist.gov/vuln/detail/cve-2019-8073}}</ref>) that enabled arbitrary code and an alleyway traversal (CVE-2019-8074<ref>{{cite web |title=CVE-2019-8074 Detail |url=https://nvd.nist.gov/vuln/detail/cve-2019-8074}}</ref>).

== See also ==
* [[Adobe ColdFusion Builder]]
* [[ColdFusion Markup Language]]
* [[Comparison of programming languages]]
* [[Fourth-generation programming language]]

== References ==
{{Reflist}}

== External links ==
{{Wikibooks|Programming:ColdFusion}}
*{{Official website}}

{{Adobe Systems}}
{{CFML programming language}}

{{DEFAULTSORT:Coldfusion}}
[[Category:Adobe software]]
[[Category:Scripting languages]]
[[Category:Macromedia software]]
[[Category:Web development software]]
[[Category:CFML compilers]]
[[Category:CFML programming language]]
[[Category:JVM programming languages]]