Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

serializing objects - loses methods - the point being?
Hi

I know that serializing an object will lose the methods. But whats the point in that? What

Validation
Hello

I know this is a really vag question.

I need to have a input field on a form th

Staff Induction System - No idea where to go from here!!!
Hi there, I'm pretty new to PHP and Mysql so could really do with being pointed in the right directi

Sessions work for me and not others?
I'm having a bit of bad luck with sessions. In the past they have worked fine for me, but this time

help with this code please?
Hello,

I am trying to build a remote upload script for my image hosting site.

I am usi

imap: how to save a copy of sent emails to sent elements
Hello my friends,

I am writing an online emailing application with inbox outbox/sent elements

Looping Problem
I've got a client that has a database with about 200 events at any given time. I'm trying to loop t

what business processes?
Hi,

A general question. What business processes (like OTC - Order to Cach, P2P, R2R etc)

data type in column definition
Hi,
I create a table with column called "Direction of Travel code ".
The travel codes in t

big pagination problem in php
<?php

$connect = mysql_connect("localhost", "root", "")