Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

php web service error
hey guys,
I'm working on a project requires the use of web services. I've been trying a few tutor

PHP error. Need help urgently
Hi,

I am programming a php site and have a problem that i just cant find out how to fix. When

Is there a function ... auto send IP
Is there some function that can be sent to a ddns service that returns the ip address of a ddns forw

error checking breaking my code
Hi there, OK first of all, big apologies for what I assume is really fundamental errors in the struc

Captcha problem users just refresh and it will let them auto submit again
Users will just re submit and not have to enter the new captcha.. ? Lol but if i refresh the page, t

need help about
i store the value of my select statement result to an array and stored it to a variable named $fname

that old Malformed Headers problem again!!!!! HELP!!!!!!
I've read the http://www.phpfreaks.com/forums/index.php/topic,37442.0.html

I don't think my c

unexpected T_SL without a shift left token
Nothing too see here, I'm an idiot and resolved the problem.

How do I send data using an html link
Hi

If I have
<a href="main_file.php">

How do I send data t

What's wrong with my code
sobbing for many days, still don't know why please Help. Why my page isn't posted correctly. In a