Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

* Gridview and Detailsview in UpdatePanel, insert mode problem
I have a GridView and DetailsView working together. When a record from Gridview is selected, Detail

My query is being run with no results.
I have this.

Code: function DropUser($duser_id, $user_email, $user_username) {

Validating time
Hi Guys

what do you think of the following approach to validate a 24hour time:

http://

ereg_replace in Wordpress
Heya - so I'm working on this site: http://world-of-smiles.theportlandco.com/new-patients

The

$get problem
Hi Guys ...

can you please tell me what i am doing wrong here
Code: <?php

Filtering an Array Based on Value
I have a very simple script set up that pulls data from a database and is output using this code:

building a function with multiple outputs
I want to build a function that has multiple outputs.

I know but am not to sure how I should

Progress bar tracking file downloads
Hey guys, was wondering if there was a way to track how far a file has been downloaded. I know there

php libs/ browsercap.in
ok i have a host that refuses to stay current. they control my php settings and libs. is there a way

php mail form text wont appear / javascript included
Guys/gals...

I am running into a problem whereby I have a great piece of javascript code that