Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

IMAGE - SERVER SIDE scripting help...
How to receive pixel data of an image and buid a bitmap file on the server using the HTTP POST metho

Onclick problem in Firefox
Hi,
I am using a . It doesn't seem to

problems with script
I made a small script wich exchanges points in my website:


<?php
session_start

Contact Form Not Working When I Add Validation Codes
So I built my first working PHP "Contact Us" like form. But, I have been trying to now mak

serializing objects - loses methods - the point being?
Hi

I know that serializing an object will lose the methods. But whats the point in that? What

Transform value 0 in no and 1 in yes help needed
Hello,
I have this in the table: "value" type int 0 to represent false and 1 to represe

Add trigger to UpdatePanel programmatically
Hi,I'm working on a website which uses AJAX and Masterpages. What I have is an AJAX UpdatePanel whi

How to validate from 2 possible answers
Hi

I hope somebody can help me with what will probably be really simple, I'm pulling my hair

get url?
how do i get the url of the page i'm currently on, on my website.. i think its get header.. how do i

Using the $_GET variable to view certain records
Hello,

First let me explain my problem, I have 2 pages the first page pull a list of Guide ti