Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

is_dir() problem
Hello,

I'm buidling a php scripts that dynamically get's subfolders from a specific folder.

[PHP HELP] Php order form.
Hello to everyone @ phpfreaks. Im new to this site and hope to learn lots of things here.

Fir

Remove directories not empty
hi,
i have an array that contains some names (1,4,6,56...). Every integer is a name of a folder.<

Help with captcha script needed
Hello,

I am working on a script where reCAPTCHA or a similar form of CAPTCHA will be used, f

MySQL query problem
When I try to run the following piece of code, I get this error:
QuoteWarning: mysql_query(): sup

Form submissing with PHP and JQuery/Ajax
I have searched everywhere, but cannot find a solution for this... I have worked all day trying to g

word wrap in emails help needed
Hello, I understand how wordwrap works in php and have used it well before. However when I used wor

EU VAT Package 2010
Does any one know whether SAP will be developing new reporting functionality due the new VAT rules t

Deleting Partners on the Customer Master.
Does SAP handle removing the Partner from Open Sales Orders when a Partner is deleted in the Custome

PHP/Database issue
My friend is helping me make a database where you go to a certain webpage of my site and the page wi