Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Sort a two dimensional array.
Hi. I've set up a two dimensional array that reads as follows:

Code: $modifiedData = array(

how to remove in php string display
My code is $message="We're looking at developing our website."; $body= "My mess

Displaying image pathname instead of image
Hello

Im trying to upload and then display images from a mysql database - Its only basic and

DataTable Help Required
Hi all I am creating an app that utilises and MS Access back end and queries it quite a bit at vario

Accessing element of object array
Hello

My object looks like this:


Array ( [0] => User Object ( [id] =>

Blocking video streaming
Hello everyone,

I post a message here because i didn't find any solution yet.
I just finis

file_put_contents and createimagefromjpeg
All,
I do somethings and then I have the following code:
file_put_contents('./test/'.$filename

Table control is disappearing from Screen
Hi Experts,

I have a screen with multiple table control(TC). Each table control has two c

Probably Easy, Need help with Check Boxes in PHP Code
hello,

Thanks for looking this over and helping me out. My problem is I have a online store l

Something like an INI editor or a DelimitedText-Editor
Hi all,

Am very, very, very new to PHP and not sure if I should be posting this to a Javascri