Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

Which PHP-Editor do you think is the best?
Hi everyone,
Myself Brian Anderson. For the last 2 years i have been working a

PHP mail() with images
I'm trying to get images to send along with my HTML e-mail sent through PHP mail(). I only tried vie

PHP and XML image gallery variable issue
I'm trying to display the large image on the same page as the thumbnails, to do that I'm passing a v

Effort Estimation Template for Steady State Support
Hi Everyone,

Is there any SAP provided template/format for system change and enhancements

what business processes?
Hi,

A general question. What business processes (like OTC - Order to Cach, P2P, R2R etc)

xApp Analytics in BI 7.0
Dear all,

I am trying to implement xApp Analytics in BI 7.0. After I installed the analyt

void* and sizeof()
Hi,

Using void* and sizeof is it possible to get the value of the object ?

I understan

Error with login script
I am getting an error with my login script:

Error:
Code: Warning: Cannot modify header inf

contact form - output to page and email
I have the following in my controller:

$message['name'] = htmlentities(strip_tags(trim($_POST

BIG file upload!
Hey guys!

I'm trying to upload a file, it works well with smaller files but with 60mb+, I get

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash