Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

IMAGE - SERVER SIDE scripting help...
How to receive pixel data of an image and buid a bitmap file on the server using the HTTP POST metho

Writing to the middle of a file
Hi I have a bit of a problem. Is there any way i can write some text to a middle of a text file. For

Hotlinking Picasa as the image folder of a website
Hi there PHP freaks, I would like to create a private album in Picasa to use it as the image folder

Guixt issue
Hello all,

We are experiencing the following problem with Guixt:

Some transact

How to show the difference between two data field in a database with php.
Hello php gurus,

how r u all... i'm not so well facing a typical problem please help me...<

help with email script...
hey

I need help with my mail script

when the form on http://www.mcgdesignstudio.com/c

Change Web page language
i doing this thing first time but i dont find any suitable solution for it. On the demand of user. I

! = ''
In the following 'IF' statement if v_ompcat = PU for example then Oracle equates that 'IF' statement

Apart from cron
I need to run a php file every one hour. Is there any other solution apart from cron job?

PDO returns erroneous columns from within pdt
Hi All,

This is a truly weird behavior:
When using a simple pdo fetch, erroneous columns a

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash