Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

Fetching META TAGS through
Hello everybody
I want to fetch meta tags of a domain.
It will be done from following code of

Checking BOM Authorization Group
Hai Friends,

I have developed a mulitilevel BOM display report. End users have been assig

Multiple PHP errors when clicking a link..and..removing a ghost..
Hi - I have 2 problems with a new website - homeswapvacations.com, which I need help solving.

writing my own sobel filter convolution - something is wrong
I am trying to keep it very simple, I cant see anything wrong with my logic, could anybody help poin

Show specific day of the week
I have been racking my brain trying to get this function to work properly and it is doing so for eve

CODE NOT WORKING
Code: [Select]<?php
//include shared codes

include '../lib/common.php';
include

show random images
hey guys

can someone please suggest a way in which the following code can be edited so it onl

IS Retail & Manufacturing
Hi

Can IS Retail and Manufacturing activities be done in same instance ie. in same client

Function
How can I make this function that once you click the link in the code it takes you to a new page wit

DELETE rows based on content
I have a link in my rows

$bit="http://bit.ly/abcd";
$query = mysql_query("D

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash