Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Limiting checkboxes?
Hi guys,

I have this code: Code: if(isset($_POST['selected'])) {
foreach($_POST['selec

[function.file]: failed to open stream: No such file or directory
Okay I wrote this little script to upload a csv file that is located on my webhosts server to a mysq

Take info from one coloum and move to another
Hi all,

I have this:
Code: [Select]$array = "SELECT stock_id FROM stocks WHERE stock_

Registration
ok so i have a site where people can register and login which works now thanks to someone on here th

Multipe Dynamic Controls & AutoPostback Issue
I currently have a need to create many dynamic controls (Example Textboxes) that need to do a PostBa

natcasesort works on one server but not on another
Hi

I have a problem that I was hoping that someone can help me with.

I'm trying to use

search function
HI guys,

if anyone could point us in the right direction of how to do this, or provide some t

array_diff weirdness
I'm using the following bit of code

$diff = array_diff($pids, $pidlist);
$diff = array_va

PHP Redirecting
Hello everyone. Is there a way to redirect people to pages within a statement in PHP? Since there is

ASP.NET 2.0 - Enter Key - Default Submit Button
Hi,One of the most annoying things in developing web pages is handling the "Enter key" for form subm