Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Getting the full city list from maxminds geoip database
I am suprised I can't find any references to this.

I have maxminds geoip lite installed and i

Insert data in Mysql and move to another page
I'm stuck with this simple problem. I need to insert data in Mysql and then hit submit and move to a

Typing math
I've added support for typesetting math using LaTeX on the forums.

Example:
Code: [Select]

Can't find a decent web analytics!!!
I've downloaded and installed Piwik. It's location detection based on IP addresses is fairly inaccur

Entering Data Problem
Code: $result = mysql_query("SELECT * FROM flights");
while ($row = mysql_fetch_array($

records between 2 dates
Hello all,

I have a date tracked table which contains effective_start_date and effective

php web service error
hey guys,
I'm working on a project requires the use of web services. I've been trying a few tutor

check_changed_data - I can't get data from the called method event
I use check_changed_data to trigger my event method.

The method delivers er_changed_data.

Simple PHP/Java Help..
Hi,
I'm trying to build a little program to do with calculating postage. Unfortunately i haven't

output_buffering so rewrite
I'm planning to rewrite some of my scripts so they don't have to use output buffering to accomplish