In addition to Shawn's answer, one important thing no one's mentioned is that you may be laboring under a misconception about queries in CF. One that could potentially have some very unpleasant consequences to the database, if not careful.
Being able to intermix CFML and SQL doesn't mean your database server executes CFML code
Databases servers don't know a thing about CFML. In fact, a database server never even sees any CFML code within a cfquery. All CFML (and/or cfcript) code is executed by the CF application server, before the database server even enters the picture.
So what actually happens when you intermix CFML and SQL? Conceptually, when the code executes:
The CF server attempts to evaluate any CF tags/functions and
convert them into literal values. Those values are then concatenated
with the rest of the plain text SQL, to form one big SQL string.
CF then hands that SQL string to the database for execution
The database server attempts to execute the SQL string and returns any
results to the CF server
The CF server converts the database results into objects, like
a "Query".
So as you can see, there's absolutely no mixing of the two. CF does it's job processing any CFML. The database handles any SQL. Never the twain shall meet.
What's the potential problem?
Take a query like this. It won't crash, but it won't produce the expected result either.
<cfset FORM.newAccountNumber = "1234,ABC">
<cfquery datasource="dsn">
UPDATE someTable
SET AccountNumber = '#listFirst(FORM.newValue, ",")#'
</cfquery>
What actually happen is this. First, CF executes the list function which returns the literal string "1234".
#listFirst(variables.newValue, ",")#
CF then plugs that literal into the rest of the SQL statement, producing this:
UPDATE someTable
SET AccountNumber = '1234'
When sent to the database, that statement sets every single account number in the entire table to the same value: "1234". Almost certainly, not the desired result.
Understanding how CFML code is interpreted within queries can help avoid some truly unpleasant consequences to your database. Especially if you don't have recent backups...