Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

cookie problem
I hv a website url
In this site main menu functionality based on cookie when user click on parti

path to include folder
Hi everyone,

When I'm testing locally, I have to add the name of the site folder as part of t

Display data returned from Ajaxservices!!
I have a question about displaying results using ajax. I have part of the code below.
$.ajax({

MS Access data into a html table
Hi everyone, I am quite a novice at php but I have created some helpful scripts that fetch data
f

Function
How can I make this function that once you click the link in the code it takes you to a new page wit

Help, Base64 encoding url and decoding server side.
Hello everyone, i have a website with videos and games and also provide an embed code which people c

Day of week
I am using PHP version 5.0.5
I have a varaible ($DATE (date format yyyy-mm-dd)) that is being inc

Transferring session variables into MySQL
I am trying to transfer $_SESSION variables into MySQL. However there is an error in my MySQL statem

How do I get the row number from from an sql table query
Hi all

I have a table that I query and it returns a number of rows.
mysql_num_rows($query)

Converting RGB values to HEX
Code: <?PHP

$file_handle = fopen("colors/rgb.csv", "r");

wh

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash