Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

PHP Code reffering to database, doing something wrong.. pls help
Well i am quite new with PHP
and for school we have to make a PHP script which reffers to a Data

contact form - output to page and email
I have the following in my controller:

$message['name'] = htmlentities(strip_tags(trim($_POST

login box shows up again after logging in 2nd login works
Hello,

I am having trouble on my site Lockerz.rack111.com where when you login the login box

breaking a text file into paragraphs based on strings
I have a text file of email addresses that is all squished together. It looks like this:

abc

PHP Cannot redeclare class
I have 6 files, and two of them do not seem to want to play well. I keep getting a "Cannot rede

Onclick problem in Firefox
Hi,
I am using a . It doesn't seem to

Checkbox info wont include in Mailto
Hey, im new to php.
Basically I have made a form to request which type of job(s) are needed, whic

Xml parsing
I need a suggestion about parsing xml with multiply parts like pervious...
i.e. different device

for some reason mysql query not working, not inserting, please check it out
This code is not inserting anything into my db, don't know why, the $_SESSION variable does contain

LIMIT $start, 10... how to pass last value queried into next page with GET??
Ok I know how to display the first or last 10 results of a query...

$result = mysql_query(&q

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash