Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

Displaying values from a SQL count...
Hi,
Easy enough question i just forget the exact method ..
I have ...

Code: //count win

Where am I going wrong
Been trying to work this out for hours

I have two tables called 'Genres' and 'Films'. Genre

Saving PHP output as a file
I wondered if anyone knows how to save the rendered output of a PHP script as a file?

I have

Send current URL in URL with a $_GET variable problem.
Hello community,

I have created a function that gets the current variable of a page, example:

Notice Undefined index: reset/ Attempting to redirect, works, but get a notice
Full Header.php is:
Code: [Select]<?php
$reset= false;
$reset= strip_tags($_GET[&quo

PHP, Arrays & A Lot Of Confusion
I've been doing basic PHP work on sites for a few years now, but I've never been tempted to learn ho

php require help needed
Ok i tried to use the search funtion but the word require is everywhere.

i'm really new to cr

Echoing ASCII code
I have a php page that splits a string into chars and then echoes the ASCII code for each char. I'm

SAP Management Console is blank
Dear All ,

I am facing problem in my des sever suddely in SAP Management Console is blank and

controlling/creating accounts with privileges
hi all,
i'm trying to figure out how i can create/control account with privileges, for instance a

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash