Injection attack should not be an afterthought worry, but just a standard you follow as a matter of fact when you're coding. The funny thing about this all thread is that in ColdFusion you have built in immunity as long as you build your queries using sql parameters. As for the rest - efficiency and scaling are not hard to deal with if you just form the habit to consider them as, again, a matter of fact task to perform.