Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Setting condidtions for an input box
Hi all,

I would like to set a condition in a txt box that says the number a user enters has t

Preg_match unknown modifyer
Hello,

Im trying to write a little script for my forums i need to get the reply from my forum

Code error with Index.php
Error: Parse error: syntax error, unexpected T_STRING, expecting ',' or ';' in /home/runevid/public_

How do I send data using an html link
Hi

If I have
<a href="main_file.php">

How do I send data t

header redirect problems? please help
Ok i am making a site that generates youtube thumbnails and i am generating an image that displays 1

PHP Captcha Error help - replace the "die" command
Hi All,

I am after a bit of help with a Captcha spam protection box.

The site gave me

Prevent PHP mail( ) from appending hostname to from address
Hey guys,

I want to be able to send texts to phones via email (since each phone has their own

Upload, SSL and more php help
I recently just installed a ssl cert and do i use https for the whole site or just for the checkout.

I didnt code this but I need help with it
I'm sorry. i'm not a coder. I have this script for forcing download and previewing mp3. The guy that

Blogging s/w
heya frndz!!! i want to start a blog.... m looking for a s/w like oscommerce which is thr for e-comm