Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

how do i display data on a page from mysql
1 - do i use this code at the top of each of my page i wish to only alow access if there as been a s

Internal Server Error issues
This has been bothering me for weeks and I've been trying to solve it without asking for help, but e

php + mysql count consecutive data
I have a database of values and I want to work out how to display them if the values match a consecu

Warning message
I've put a website that I was doing live and I'm getting this warning message when I try to add a ne

Filtering an Array Based on Value
I have a very simple script set up that pulls data from a database and is output using this code:

How do i do multi uploads?.
Hey i would like to do this : http://hosting.mrkrabz.net/

I've got the base down you can uplo

ALV List display - header width adjust
Hi,

I am using REUSE_ALV_LIST_DISPLAY for my ALV display.The width of the ALV varies for

How to file_get_contents when login required?
Hello!

I am trying to read data from a page that you have to be logged into to view, I am try

how to make database item unique
Hey guys,

is it possible to do this:

I have the database item $title being pulled for

Xacute search within SQL results
I have a query that is pulling data, and I want to return a specific value from the results of that

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash