Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

urldecode question
How would I format this line of code properly?

<?php echo urldecode($_GET['Title']); ?

Help! refer to a friend script with captcha code
Hi guys, I am posting on here in desperate need for some help with an ongoing search I have been doi

PHP Session Issue
I'm having an issue with one section on my website dealing with sessions. Now I know that myself and

Looking for help reading a .txt or .ini file and outputting the info.
I have a file called Info.ini and It has the following info:
Code: [General]
Online=0
I wou

Pass sql into pl/sql and create RMAN duplicate script.
Hi,

I'm new to pl/sql and I'm trying to write a script that will generate some RMAN comma

HTML form problem
Ive made a form to that i want to send to my email via PHP. but when it send only the name's etc sen

Baffled by Undefined Index in Simple Array: Please Help!
Hello. I have a form which posts an array to this script. However, I can't seem to access the values

Php - mysql store data and use it later?
Hi, i' making a login page at the moment, however my username + password is stored many different pl

Something Non-Traditional. Can we solve?
I have an idea for an application here. It's mostly flash, but it couldn't work without a somewhat n

Convert array to string and write to csv file
I am looking to write a MySQL query to a csv file.

At the minute I:

check for the orig