Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Scrolling news bar and MySQL
I am not sure if this is the correct forum to post this on. If not, I apologize. I am still pretty

Placing and array within an array then sorting it!
I have a page that runs two large mysql queries and saves the results into arrays, in php I then per

how to put the 0-100 numbers into 1.txt and 100-200 into 2.txt ?
how to put the 0-100 numbers into 1.txt and 100-200 into 2.txt and so on 200-300 into file 3.txt ?

Changes to hosting company's server has affected web contact form
I started a thread a couple of months ago about the contact forms on my client's website. Basically

I am stumped
OK. Here is what I am trying to do. I have the conditions set, and if the conditions are met, I want

ereg_replace issue
hi there people

i have this code happening with regards to my wamp server. is this something

smart reading from a text file
Hello there fellow coders, i was wondering if one of you wouldnt mind helping me with this problem i

Mysql query, two times?
Hello to all,

I'm new to php coding and i like it alot. I need help with some noob stuff.

Will this protect from mysql injection?
I do not want anything like DROP TABLE to work or any type of coding..

Heres my code.. is it

SQL Query/echo not working
Hey all,

I'm trying to run (what I thought) was a simple operation and it isn't working. I h