Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Adding to an Int row in db
Hi, i have a database which houses all of the users of my site. One of the columns is for points whi

matching numbers inside ( )
I know I can match numbers by just [0-9]+, so I thought matching numbers inside ( ) would be somethi

Curl timeout breaks script
So im having difficulties with skipping timeout error in curl
my script calls different functions

Creating a function
Basically i wanna put all this code in a seperate file

Code: <?php

set xml path in flash when xml created in memorystream and webrequest
i am creating an xml file using memory stream and i want to load this xml file into the flash on cli

How to sum these output values
Hi

I need sum the month totals
SELECT region_name, area_name ,SUM (CASE WHEN S

Big Problem!! Please help
Hi Guys,

Im making a website for a friend have encountered a really annoying problem. When ev

show the direct link into href
I want to display link on the page. i am fetching the data(URL) from database,actually before that i

Refining of search Criteria
Dear Friends

I need a help, I have a search page which of cars related, which has different s

Files in current folder. Should be an easy fix.
Never mind. I've asked about this before and just found my answer. Anyway to delete this?