Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

mysql_real_escape_string making variable equal nothing
i post a form and i post the variable:
Code: $var = $_POST[variable];then i echo $var its what i

URL Rewrite issue
Im created a series of Rewrites and on page checks to make sure the correct url is being called. But

Add User script "Could not execute query"
This should be an easy script but I can't get it to run. Can someone please help me?

<

Simple MySQL query...
Hello,
How could I do a mysql query that does this: SELECT * WHERE date/time < 5minutes ag

'grab_files', multiple extension?
hey guys,

can anyone suggest a way to make to following line of code look for files with more

Count
Getting the same count everytime

Code:
$visitquery = mysql_query("SELECT COUNT(*) FR

in php, link returns to the line
When I add a link in a php page, the link word returns to the line (as a
would do)

Examp

Memory Allocation
Hi folks,
see this ex:

int v=5;
v=v+10;

then what will do the compiler before th

* Gridview and Detailsview in UpdatePanel, insert mode problem
I have a GridView and DetailsView working together. When a record from Gridview is selected, Detail

How to ... (FAQs)
... get e-mail notifications As several people asked how to get e-mail notifications when new posti

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash