Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

filesize problem
i use ubuntu 9.10 and i have mountet a folder from an windows

/mount/FOLDER
/mount/FOLDER/

SWF image using php?
Hello once again.

My latest en devour requires me to produce an image of a static .swf that i

utf8_general_ci error ??
I have all kinds of data to be inserted in database table

//I am getting this error

Yo

How to add an image/C++ OpenGL?
Hi,

I have been trying to look online for this and, so far, I haven't found anything usef

update 2 columns by doing inner 2-column query
Hi,
is something like this possible?

update contract_all set col1,col2 =
(

Multipe Dynamic Controls & AutoPostback Issue
I currently have a need to create many dynamic controls (Example Textboxes) that need to do a PostBa

help with email script...
hey

I need help with my mail script

when the form on http://www.mcgdesignstudio.com/c

output_buffering so rewrite
I'm planning to rewrite some of my scripts so they don't have to use output buffering to accomplish

Encrypt php code?
Is it possible to encrypt php code in files,
so that it displays a load of unreadable characters

Multiple Do / While Statements?
I'm still very new to PHP, and running in to a problem when trying to execute a do/while loop inside

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash