Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

update sql when refresh - php
hi
I have made a table (attachement)

the users can update the sql database using + or x bu

Web Host List
Here is a list of web hosts that offer PHP and MySQL. It is no where near a full list, but it is mos

Track downloads' status
Hello,

I need to make somehow, some system, to track whether downloads are completed or faile

JQuery, Masterpage, and Control issue
Hey everyone, I am using JQuery in several sites so I thought it would be best to place the library

Cloud Computing?
Hello,

I was wondering if anyone could help explain this term to me. I'm starting to hear it

max function question
Hi All
Ihave a table that holds shipment numbers and dates like this

select * from

php or sql?
Sorry not sure if this is a sql problem or php the following code is supposed to delete data from th

bind error during socket programming
i am kinda new to socket programming. wrote the below code for a server. but getting the bind error

images aren't rendering
I'm trying to call a JPG file from within PHP (in an effort to hide the actual JPG folder). The imag

Ajax Issues - Update Panel / Timer. Intellisense doesn't know about them
Type 'System.Web.UI.ScriptManager' does not have a public property named 'UpdatePanel'. That is wha