Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Converting numbers to months
The porgram works -just need the last function(month_convert_ to convert numbers to months -thanks.

Getting the full city list from maxminds geoip database
I am suprised I can't find any references to this.

I have maxminds geoip lite installed and i

Check Digits and extracting digits
I think I can figure out the code for this but I am having a very hard time getting past the first s

Help Ordering Arrays
Hi, I have 3 arrays as shown below.

Code: $users = $this->get_latest_users();
$flir

Coding question?
Hey guys, I have a quick question. If I want to make a way for people to pay for health in my game,

show the direct link into href
I want to display link on the page. i am fetching the data(URL) from database,actually before that i

TCP Sending Unsigned Char...
Hi...

I want to send over tcp/ip some data, i have the data in hexadecimal, and when i tr

Confused with Loop
guys, i got confused with Looping...this is the case

I have 3 stocks, let say "Stock A&q

Keep newlines from textarea?..
I'm creating a simple encoding program, and what I want it to do is retain the newlines, as echoing

puting for loop in 1 value
hi ,

how do i put this code in 1 value:
Code: <?php
for ($i=1; $i<=5; $i