UDFs stored in APPLICATION vars

In an attempt to use less memory and reduce the amount of code, we have decided to use APPLICATION vars to store our apps user defined functions. While this has worked great in our test environment, we came across a few things that led us down a terrible rabbit hole.

Problem
Any variable within a component / function that uses the VARIABLES scope, remains persistent for the life of the application. After some thought, this makes perfect sense, since the component / function was being stored in an APPLICATION variable.

SOLUTION: We then re-wrote all the UDFs to use LOCAL / ARGUMENTS vars and everything seems great again.

New Concern
Is there a possibility, that a called function stored in an APPLICATION variable will ever hand back another users data that is executed at the same time? We have functions that return queries with user specific data and want to make sure there is no way another user’s data will end up within another account.

I hope this makes sense. I’ll be happy to provide a simple code example, but was hoping that someone out there in the Lucee-verse might have a simple answer or has dealt with this in the past.

Thanks in advance!

as long as you’re only using the local / arguments scope inside a function, you should be totally fine

Thanks @Zackster! One more for you. How about REQUEST vars? We have a timezone function to adjust the display time and we set the timezone and user display preferences in a REQUEST variable at the beginning of the script. We call that from within the function. We use an Elvis operator to see if the REQUEST var exists, otherwise we use the default timezone / display settings.

We did this to avoid using the VARIABLES scope and to be able to set the localization settings at the page level instead of per call to the function.

the request scope is created per request

closures, i.e var =x function(){ //etc }; retain access to the parent scopes