Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

C++ API to Oracle dB
I need to perform a select command to the Oracle dB to obtain information from a table.
What libr

remove trailing slash from array
I have the following array which contains trailing slashes I need to remove. What is the best way to

How do I send data using an html link
Hi

If I have
<a href="main_file.php">

How do I send data t

PHP arrays into arrays need help
Hello
I am trying to highlight the days on my calendar based on the dates that i have in my datab

Big Problem!! Please help
Hi Guys,

Im making a website for a friend have encountered a really annoying problem. When ev

HOW to get the bind variables list.
I've the following problem : I've some SQL queries stored in my DB as VARCHAR2 values.
I need t

Generating unique numbers using php
Hi,
I need help in generating unique number using php.I tired using rand() in php.But, by using r

Consuming third party Payment Gateway API from Procedure.
Hi All,

First of all i would like to thank all the people of the oracle forum for providi

Passing an array of values From VB6.0 to Oracle PL/SQL Function
Basically we are using VB6.0.

When we try to pass an array from VB6.0 to an Oracle PL/SQL

insert/update functions for mysql, what do you think?
I am working on two really simple functions that automatically generate (and execute) insert and upd