Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

Taxonomy? Classification? Categorisation?
Not sure if there is a way around this classification problem
I have a supplier who produces

PHP and SMS
Hi all forum members. I am new here and am unsure what category shoild I post this in.
Moderator

Warning: Cannot modify header information - headers already sent by (output sta
Warning: Cannot modify header information - headers already sent by (output started at /home/praylif

JSON SORT WITH PHP
I have two products that I want to sort by say "Id:17, value: xxx" using php
The page w

search function
HI guys,

if anyone could point us in the right direction of how to do this, or provide some t

ok i need to join all this pages to make 1 neat code
i have 5 pages that make up my tv guide it works 100% but i want to make it 1 page if i can or 2, i

Drop Down and text box issue
Is it possible to set a drop down list and text boxes to a certain width?

here is my code

NOOB needs help with upload file
The intent of this form is to create a folder for a client and upload an image into another folder '

Feed Maker
Hi all.
First of all I must say I am not a php developer so I am afraid I don't know much about i

$_POST variable un-useable
I'm trying to use a $_POST variable in a mysql update statement but i can't use it for some unknown

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash