Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

phpMailer will not connect using SMTP
I am trying to use phpMailer with smtp:

Code: [Select]$mailer = new PHPMailer();
$mailer-&

Save remote XML to local website folder
Hi, I hope you can help me out. I would like to be able to pull an XML file from another site and t

How do I send data using an html link
Hi

If I have
<a href="main_file.php">

How do I send data t

user administration
Dear @all,

what I have to do to set the user defaults for new users. At the moment I woul

Async WSAConnect failed on XP with error code = 2 ("File not found")
Hi all,

I have very strange bug, please help me if you can.

It is reproduced o

Get last modified date of web page
Hai All,

In php how can i get last modified date of a give web page . I have tried to g

check how many commas the variable containing the query has between [i]select[/i
Hi...

iv made an sql table that contains id number - name of sql query and an sql query.
T

do while conditions
i want to display 6 images in a 2x3 table
now what would be the correct logic to
count that th

Losing 'page' data
I have this code that allows me to update my database. But after updating, I lose the $_GET['page']

Retrieving Data from Two Different Databases
Hello All,

Ran into another problem and would appreciate some help! I have two datab