Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Problem with passing variables
I'm not really a php programmer so I'm really struggling with this issue.

I have a banner s

Passing an array of values From VB6.0 to Oracle PL/SQL Function
Basically we are using VB6.0.

When we try to pass an array from VB6.0 to an Oracle PL/SQL

Amatuer requiring assistance
Beginner and amateur in need of assistance

My Site - (Spare Parts for Domestic Appliances)

Career Change into SAP
Hai
I am sajesh ,did my diploma in Mechatronics i have a 4 years of experience in

C problem struct and string
Hi guys,

This is my first post and I'm hoping the experts here can help me solve my problem.<

Displaying a clickable playername
I am going wrong somewhere with the mysql_query, can someone please put me straight?

$playern

Binding 2 UDP sockets on same port, connected to different destinations, 1 receives
Hello,
My application wants to send/recv data to 2 different UDP ports on a remote computer, us

Must-Know Topics of PHP
Can you guys list the must-know topics of PHP. I am still a learner and I am trying to cover most of

Passing vars to the DB
I have 3 small testing tables:

ID TYPE
1 pepperoni
2 C. bacon
3 taco

ID TY

Basic Forum Tutorial
Hi, I'm new to PHP. I want to build a basic forum for my site using PHP and MySQL. I've searched t