Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Mail functionality from localhost to server
Hi

I am facing problem of mail functionality.

When i tested mail functionality in my

Quick Syntax Question
Hi folks,

I'm getting the following error: "unexpected T_LNUMBER". I'm trying to b

How to insert random unique values in 2 columns ?
I have table with 2 columns

Create Table code_for_code (
first_code varchar2(10) uni

How to get exact 3 moths post date from today date using javascript
How to get exact 3 moths post date from today date using javascript
Please help

Oracle11g Patch issue
Hi all,

I'm getting the following error while installing Oracle11g Patch 11.1.0.7.0 on IBM-AI

Please help with code for SMTP authenticated PHP email form
Hello, I'm creating a PHP email form, and for this particular server, I have to use SMTP Authenticat

Select all entries from database that include a phrase
I have a database of clubs - one of the categories is meeting time and place
I would like to have

Help! refer to a friend script with captcha code
Hi guys, I am posting on here in desperate need for some help with an ongoing search I have been doi

Using mysql_real_escape_string for displayed content
On my website users can input data into a textarea and it will store it in the mysql database. But,

FFmpeg Images 2 Video conversion problem ??
I got folder full of images , number of images = 600 , I want to make a video which plays one image