Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Displaying image pathname instead of image
Hello

Im trying to upload and then display images from a mysql database - Its only basic and

List/Menu Box
On an edit page when you want something to select what a user has previously selected from the datab

Edit MySQL Row Using PHP and HTML Form
Hello,

Here's what I'm trying to do. Build a page where a user enters a MySQL row number in.

Secure pages Sessions vs. Cookies & session_destroy() help
Im new here and new to PHP, I hope you can help me with some questions.

Im writing my web ap

RSS feed - FeedList for WordPress
Hi,

I'm trying to alter the FeedList plugin for WordPress so that I can click on the title of

New Login Script
Hi all, i attempted to create a whole new login script witch isnt working for some reason i dont kno

Form Help
Here is the form:

Line number On/Off | Expand/Contract<? include("../include/sess

Showing selected item at top of list
Hi,

I've got a list of names which i am fetching from database like this:
$qry = db_query

output printing as hexadecmal... XD
Everything works except the calcem call for the totusold and totuprice. The out put shows up as hex.

mysql query with single quotes in a variable
$sitedetails = "INSERT INTO vars (address, sitename, description, ownername, theme) VALUES ('$u