Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Trying to add functions to table
I have this list of characters and I'm trying to figure out what I have to do to put the results of

foreach and array need help combining
Hi guys.

Here's the code

Code: array(
'tag' => 'code',<

check comment for html
hi, I just wanted to check if a comment a user posts contains HTML, and if it does, to not allow it

Error when call dll from oracle
Hi all, please help me!

I have dll write C language, I want call it from oracle procedur

Retrieving Data from Two Different Databases
Hello All,

Ran into another problem and would appreciate some help! I have two datab

Custom array sort? asc then desc
Any ideas how I could sort this array? I've been trying for a while. Maybe with usort, but I have no

how can i make a .gif images for my site
Dear Friends ,

Pls solve my problem , I am starting making new site but i dont know how can i

Kill a process
I have a question - how can I kill a process from a command line or by using Oracle SQL Developer? I

Not loading image
When this function gets loaded it doesn't load the image just trying to figure out why.

Code:

Parse error: syntax error, unexpected $end in
hello,
i receive the error :Parse error: syntax error, unexpected $end in C:xamppxampphtdocsh