Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

php or sql?
Sorry not sure if this is a sql problem or php the following code is supposed to delete data from th

Confusing Functions
So, I've been reading up on Functions and I like them! However, I need some help using variables in

how can i expire the submitted page using session.
hi,
i'm new to php world.
i'm using "post" method.
when i submit it,data goes to

Need help adding a timestamp to my filename/variable
Hello,

I'm kind of stupid when it comes to php and I need a tiny bit of help. I've got a f

[function.file]: failed to open stream: No such file or directory
Okay I wrote this little script to upload a csv file that is located on my webhosts server to a mysq

DATEDIFF Question
First time post, and of course it is a help question.

I am using a WP plug-in to display prev

How to add advertisment on top of videos
Hello,
I was told that i should find the answer for this problem in this forums.
I searched a

Weird Problem with curl while sending data
I am facing a weird problem with sending data to a site via curl.

If i send the value by this

grouping within a foreach?
hello all,

I currently have a list of products spit out from my db via a foreach loop. Right

mysql query with single quotes in a variable
$sitedetails = "INSERT INTO vars (address, sitename, description, ownername, theme) VALUES ('$u