Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Internal Server Error issues
This has been bothering me for weeks and I've been trying to solve it without asking for help, but e

Form always sends to error page...
Hello,
Any help will be greatly appreciated. I am having trouble getting multiple fields to be re

Extra fields in main body and php required.
I'm new to PHP so please be gentle. I have a little php script below that works well.
The &quo

$_POST
Hi, I have 2 seperate php files, and i want my $_POSt["fname"] To go into both of them, Fo

phpMailer will not connect using SMTP
I am trying to use phpMailer with smtp:

Code: [Select]$mailer = new PHPMailer();
$mailer-&

PHP FTP Can't upload Big FIles
Anyone had any success using FTP to upload a file say 90m?

im using ftp_put and it returns fa

convert PHP array to Javascript array
I have a page that gets a request sent from AJAX, and I am trying to convert a PHP array to a javasc

how to get values from $_Post with onchange="form.submit();"?
Hi, I have a form that submit to itself with a file upload field and two other hidden field values.<

displaying unknown amount of results
I am reading a directory and getting a list of folders in the directory, I want to display the folde

SWF image using php?
Hello once again.

My latest en devour requires me to produce an image of a static .swf that i