Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Members Only
Hi all, for my website i have a members area only which on members can veiw, but at the moment anyon

Running a cron job through PHP/Apache?!
Hello all,
I have a PHP script which makes a cron file from user input. When i try to run the cro

Really need helps regarding Pagination with Sort
I need someone helps regarding pagination problem...i actually want to make my page limited to let s

Can you help please? Php file
I have to write this php file to allow users to register their nicknames on nickserv

For an I

Undefined Index Notice In Internet Explorer Only
I am getting the following notice:

QuoteNotice: Undefined index: jrox in /home/ycsn/public_h

Tree Menu
Hi guys,

Can anyone help me making a tree navigation system? I have a site where I'm allowin

Need help: how to catch acess of undefined class properties
Hello. I am learning OO with PHP and have hit a problem.
Some code runs as perfectly valid code,

Session login issue
I'm wondering how to fix a problem I'm having with a session-based login system

Say I go to h

printing links
Hi every1

i am connecting to a table in sql and the looping through with a while ($ var = my

pls clear my confusion
Hi friends,

Pls solve my query .

what is the exact use of Scope Resolution Operator( i