Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

PHP switch function help
Hi, I am trying to create a search function for a directory website. On the search function on html

simplexml and xpath - Need some help
Hello,

I am trying to parse an xml which comes back from Amazon and I am trying to know how m

list files from folder, only one for each date
I have many files in a folder and wish to only list one of each date

these are the file names

writing my own sobel filter convolution - something is wrong
I am trying to keep it very simple, I cant see anything wrong with my logic, could anybody help poin

Calander Basic Spript help
hi, just starting out with PHP and have the following script:

<?php
//This gets t

Agency Business Process
Hi,

I don’t understand the process of the agency business in SAP.

In my

reating a background image
I am building a site in drupal and have a php form in it, due to certain annoyances with module buil

Displaying returned XML in another PHP page
I have an online payment form that will return XML given if a payment is successful or declines. I

I need desperate help with this php code integrated with flash please
Can someone please help me with this php code which I have been stuck on for weeks . I am trying to

BackButton Behaviour in AJAX
I have an ASPX Page AJAX Enabled!The page has a gridView and a DDL for filtering on it. The Gridview