Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

PHP Search Issue
Hi, I am using the following code to search and return flights from a database. The user searches by

Simultaneous select/update/insert
Hi

How would I need to go about when 2 users update a single row simultaneous? And how would

Email Processor
I have a few questions so this post will be a larger one! Sorry, but I'm a bit of a PHP newbie so be

PL/SQL: ORA-00947: not enough values error message
Hi all i am getting Error(25,63): PL/SQL: ORA-00947: not enough values error message when executing

Session problem?!?
Hello All! I am very new to the php world but I am working on fixing things that a previous programm

Am i doing this wrong?
Im pulling from an Oracle database some info... one of which is a field count_pnums which is a NUMBE

Calculus Help (and by help I mean homework)
Hrmmm, I hate posting about math homework, partly because it's homework, and partly because I hate w

Form a inline view based on the results of the previous query?
Hi Experts,
Can we form a inline view on the results of a previous query (another inline view)?

Multiple WHILE loops help
Hi there. I'm writing an application that is pulling and displaying results for real estate listing

How to have a log of all the status a VIM document had been ?
Hi guys,

I’m using SAP Invoice Management plugin and the /OPT/VIM_ANALYTICS transa

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash