Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

square instead of number
Hello
I do not know why but this code seems to work fine only in my xampp local insallation but n

PHP form help required
Hi all! Apologies in advance for having to message the forum for help. I know you must get a lot of

help me, how to find text on an external html site using PHP
Would anyone know how to search an external html file for a work or phrase ?

I was thinking s

output printing as hexadecmal... XD
Everything works except the calcem call for the totusold and totuprice. The out put shows up as hex.

Php navigation
I have four buttons on a php page.
If i click a button it will redirect to different php pages.

MYSQL gen help
This is my Mysql gen. can anyone tell me why this echos

MID(networkset.networkid, 3, 3) AS &q

Print 'a' to 'z' via for loop
A very simple problem..
How Can I print a to z NOT a to y ?
It is a part of a code where
<

upload photo limits
ive got a upload photo script and im just trying to make more secure currently it limits size and as

Empty text file when there is over XXXX lines of text.

define("RANDOM_FILE","/public_html/random.txt");
$randomEntry = "

Got A Free Server :(
So I was given a free server

http://shopping.yahoo.com/p:Compaq%20ProLiant%201500%20Server:1

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash