Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Working with popups and such in a class
I've recently started building my applications completely enclosed in classes. I like the fact that

getting rid of quotes in strings
sick of trying to deal with them in multiple ways (entering in and taking from database, echoing, ec

Help with captcha script needed
Hello,

I am working on a script where reCAPTCHA or a similar form of CAPTCHA will be used, f

Simple program to copy files between two computers over the web
I use logmein free and often need to move files between my two computers. Generally, I move the file

Unable to display contents in Second Drop Down Box
Hi All,

What I am trying to do is 2 dependent drop down boxes and when user selects su

Points for Wiki contribution
Hi everyone,

I want to know how long does it take for the moderator to award points for a

Problem with a select distinct
I have a problema with a select distinct, I have the next sql:

select distinct a,b,c,d fr

i have no idea why this isn't working
Code: <?php
session_start();
include("connect.php");

error_reporting(E

MYSQL INSERT ID NOT WORKING
Code: $id = mysql_insert_id();
header("Location: ./?view=$id");
Why $id pulling blan

getting most records by count
Code: [Select]<?php

$connect = mysql_connect("localhost","dam