Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

Echo-ing MySQL content and Keep Formatting?
I have data in my MySQL such as:

QuoteBlah blah

Blah blah

etc
but when i ech

php/xmlrpc class issue
I am working on xml-rpc in php to start with.

I have a class that only has variables defined

form variables from database help.
Hi all,

I would like to have a form that gives you options based on the results of an mysql q

The control with ID 'ace' requires a ScriptManager on the page
I'm trying to add a simple AlwaysVisibleControlExtender to my page, but it's not working. I get the

mysqli_fetch_assoc returns multiple arrays, how to return a single array
Hello, I am using mysqli_fetch_assoc which is returning multiple rows, so it looks like:

Code

array empty
Hiya peeps,

Ok here is the codes.

order.php

Code:

want to add a break after a certain amount of characters
i was wondering how to add a break in a blog post after a certain amount of characters... any idea o

Need help: how to catch acess of undefined class properties
Hello. I am learning OO with PHP and have hit a problem.
Some code runs as perfectly valid code,

Form Help
Here is the form:

Line number On/Off | Expand/Contract<? include("../include/sess

double and single quotes in text fields acting up... help please
Single quotes, when entered into a text field, create an sql error upon Submit. It seems to create t

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash