Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Multipe Dynamic Controls & AutoPostback Issue
I currently have a need to create many dynamic controls (Example Textboxes) that need to do a PostBa

MYSQL INSERT ID NOT WORKING
Code: $id = mysql_insert_id();
header("Location: ./?view=$id");
Why $id pulling blan

image upload, resize THEN submit form
Ok so I have a form that requires the user to upload an image, and then do something with that image

Email Script does not reach destination
Hey Guys look at this code snippet :
Code:
//read a line from the file

$myFile = "

Multiple includes losing variables
Hey all,

just starting out w php and ran into a problem pretty quickly. I'm
including seve

Check premium expire
Hi,

I am making a simple file hosting site and want to check if users premium subscriptions h

gmmktime or mktime
I live in the UK, i am within the GMT (with daylight saving time ie 1 hour difrence between summer a

User feedback after MySQL query has been executed
Hi all, I've just registered on PHPFreaks because I've got a question that I simply can't work out b

problems with php variables in mysql query
i can't seem to get the following query to work.

select $q1c from $vote_rate where id = $re

Session login issue
I'm wondering how to fix a problem I'm having with a session-based login system

Say I go to h