Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

defining website tags
Hi,

What would be the best way to define tags for my site, such as website title, url etc.

Different actions for different parts of a string
<?php
function dosomething($string, $else = '') {
if (empty($else))
$string

Revoking alter any table from a schema
Hi All,

i am working in Oracle 10g.
my requirement is to revoke all kind of DDL oper

Image upload - determine folder
I have an upload script that may be accessed from different directories. Problem is, the script is m

If statement help please.
Hello on my site I have 2 content boxes. 1 is for the main content (which is the biggest one) and th

Using CSS to format MySQL query
Hi,

If i want to have a news page on my site, which displays all records of a table in descen

help me fix these syntax errors...
I keep getting multiple syntax errors on this script like this one:

Parse error: syntax error

PHP & MS Access - Line Break
Hey Guys!

I'm pulling records from an MS Access database and listing them using PHP and I'm r

Oracle11g Patch issue
Hi all,

I'm getting the following error while installing Oracle11g Patch 11.1.0.7.0 on IBM-AI

Reduce redundancies in switch functions?
Hello all! I somewhat new to PHP, and was wondering if anyone could give some suggestions on a swit