Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

values in array being escaped
I would like to submit some values - back to the same form for checking before processing...

Error in query: Resource id #4??
hey guys, having a minor (i think) problem here that i havent been able to figure out. long story sh

Taylor Series Function
So I am working a a project for my intro C++ class, and I am having some trouble with a function for

Different actions for different parts of a string
<?php
function dosomething($string, $else = '') {
if (empty($else))
$string

Confused with Loop
guys, i got confused with Looping...this is the case

I have 3 stocks, let say "Stock A&q

Header is not working in IE
Hi ! header function is not working in IE but it works in FF, Safari, Chrome. any help please. :

check how many commas the variable containing the query has between [i]select[/i
Hi...

iv made an sql table that contains id number - name of sql query and an sql query.
T

SAP Project Module
I have seen in the SAP Project Module,plan cost and budget are not equal and even difference is sign

if else problem, help please
i have this script that i made only i try to also put in a if else for for some reason the script is

foreach help.
Hello all,

First time I'm attempting to use a foreach statement and was just wondering if my