Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

question about stripslashes and real_escape_string
im cleaning up an old app that I wrote fixing some of the vulernabilities from attacks.

I hav

frames get header location..
i have two frames, one top, one bottom. how do i do a form on the bottom frame that gives me the ur

Save User Inputs while javascript reloading!
hi..
i have written a PHP code in which i reload the page when user selects a value in dropdown..

url- go to webpage
i have an input text field and submit button.

how do i make the url entered into the textfiel

j1inmis Ouput layout changes
Hi,

Can anybody tell how can j1inmis output layout can be changed so that vendor names ge

Simple image grab script.
I was wondering if it was possible and if anyone knew how to make a simple php script that looks at

rookie looking for help coding a CSS form with PHP
I'm trying to figure out how to add PHP code to my xhtml form so that it is a working form embedded

md5 is it unique
I know this is most likely one of many simple questions that can be found semi easily. But I'm press

Need help Updating SQL Server Express DB from c# :(
Please can anyone help with:-
1 How to sructure the strSelect statement.
2 How to instruct

TimeZoneOffset
Hello,

Please i need your help. I have a system that users can use to punch in and out. This

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash