Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

User feedback after MySQL query has been executed
Hi all, I've just registered on PHPFreaks because I've got a question that I simply can't work out b

Sub-domains & calling unique content
Hello,

Is there a way use something similar to the $_GET function for a sub-domain? I to be a

Why use interfaces in PHP (OOP)
I am learning OOP in PHP and its been a pretty good learning experience so far. What I didn't unders

DATEDIFF Question
First time post, and of course it is a help question.

I am using a WP plug-in to display prev

PHP Thumbnail Creation
Ok so i use this function to create thumbnails:

Code: [Select]function createthumb($name,$fil

storing results of a function - previous result overwritten with new result
I have created a function to validate input.

function validate_dimension($value,$name) {
<

Help on Order Entry Form/System Where is best to begin.
I have a dilema and a very short amount of time at this point and I'm looking for some help on decid

update the selected existing records of database
Hi frndz,
I am new to php and get stuck....

Edit.php > Update.php > Updatea

Hits this week counter
I have a counter on my site that tracks hits, IP's, etc. into a mySQL database. It also includes the

Word filter problem
Hello,

im trying to make a filter for words inputted in to my website but i want to store the

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash