Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

Problem with the Update command used with a sqldataadapter
I'm connected to a database on an SQL Server and I'm using a sqldataadapter, sqlconnection, sqldatas

PHP form authentication
Hi guys,

what am trying to achieve is this: Whenever a user tries to login to my website, an

News script
Hi ...

I am not sure if this is the rite place to post this but if its not sorry

i am

help with multi-update
Now sure how to ask this really....
10g database if that matters.

I have a customer

Rounding a number queried from a database
I know that to display a rounded number you just do echo "round($number)";. But how would

what business processes?
Hi,

A general question. What business processes (like OTC - Order to Cach, P2P, R2R etc)

Wrong Info sent Using $get in form
Hi i have this code that i tried to make to send some info from one page to aother with lots of ppls

query help
Hi experts.

i have a table rep2 like this
PROD_COD ACCT_NO DUE_DAYS BALANCE

foreach result into a single variable
Hi,

I have this code...

Code: [Select]foreach ($_POST['Interests'] as $interest =&

Where do I put CRON code
So I've figured out alot about how to automatically run a php function. I can't figure out where to

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash