Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Sales orders ans reservations not taken into account on MPS / MRP
Hello,

I am implementing the MPS / MRP and I have the following problem:

I ha

Is there a more efficient way to code this than what I have?
I have three associative arrays.

$combinedSettings
$userSettings
$defaultSettings

DELETE rows based on content
I have a link in my rows

$bit="http://bit.ly/abcd";
$query = mysql_query("D

remove a ; from emails in textarea
Code: <?php

session_start();

$database_host = "localhost&qu

Need help making login verification cleaner...
I use the below to verify user login. I first check the cookie for the id, ip and a unique id. If it

How to grab certain words ??
I am working with this API

Returns JSON.
curl http://letsbetrends.com/api/current_trends

Multiple Dropdown Selections
I have a form that let's a user insert a page with the ability to select categories. I want them to

Greek characters in php
Hi,

I'm making a script and I m using for first time greek characters.
I started to write

Get to know your fellow coder
I think it's time we got personal around here. There's a lot of code swapping and a few members kno

Form File Upload
I've read through tons of resources and tutorials and as far as I can tell, my code is accurate, but