Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

PHP friend keyword equivalent
is there a PHP equivalent for the C++ friend keyword?

help with image text
Hi ...

see i need the text of the name and number to start in the center and always be in the

Add weeks in a query?
I have a SQL that summarizes the quantity per week. The weeks that has no value does not exist in th

Php - mysql select?
hi, i have this code:

Code: <?php
session_start();
// dBase file
include &quo

Displaying image from database
Hi,

I've got a site where that's got a database behind it. Currently it has loads of items in

php form help
Hey,

I use a control file to set my meta tags and titles

Here's an example
Code: &a

Any meaningful project for a new C++ programmer?
I want to do some meaningful program, so I can help myself to learn

Assume I know the fol

need help with php get
i have a option box that gets filled with dates, but how do i get once the option value has been cli

pointer 102 question
I read a book
1
2
3
4
5
6
7
8
9
10
11
12
int main() {

Dynamically set AccordianPane Header
I have an accordian on my master page. I'd like to be able to dynamically change the header on diff

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash