Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

mysqli_fetch_assoc returns multiple arrays, how to return a single array
Hello, I am using mysqli_fetch_assoc which is returning multiple rows, so it looks like:

Code

php wont update my db
hello,

sorry for posting in mysql forum but i dont know where exactly is the problem but here

Disable html within defined tags
I have a mysql database that allows users to enter content with html, but I also want to have a tag

PHP submit form script causing blank page
Im trying to submit a form using this script, however nothing shows up on the page, does anyone know

Google voice
I currently have a form in html, but I want it in php so the information is not in the source code.<

bind error during socket programming
i am kinda new to socket programming. wrote the below code for a server. but getting the bind error

Weird MySQL error, why am I recieving this?
PHP Code:


<?php require "global_settings.php"; ?>
<titl

Storing/displaying image urls in a database?
Hi
Basically I have the following scenario:
User chooses picture from list. Picture info is ad

Populate drop down list from table??
Lets say for arguments sake that i have a table which contains the numbers 1 to 10.
How can i get

include problem
I have my root folder as:
Code: $root = $_SERVER["SITE_HTMLROOT"]; // the server root<

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash