Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Sending UDP Raw socket
I truly need help on this. I am trying to write a test program that simulate a network environment

type check while uploading
Hi Everyone,

How can I check the exact type of a file while uploading on my site?

Here

Count of reciepients in php mailer
How can i sent a mail to large no of reciepients say 10,00,00 Using PHP MAILER

Displaying image pathname instead of image
Hello

Im trying to upload and then display images from a mysql database - Its only basic and

using a loop help
Hi guys , i need some help. I have this loop :
while ($row = mysql_fetch_assoc($Result)) { ?&

What's best way to get a user's Word doc converted to simple html and images?
Hi all,

I was just wondering if anybody has any experience of this.
Basically, I'm buildin

php multiple action on submit
I have a form which says:

<form enctype='multipart/form-data' method='post' action='pr

Validating time
Hi Guys

what do you think of the following approach to validate a 24hour time:

http://

Warning: session_start() [function.session-start]: Cann.....
hi, can someone help me with this? I keep getting this error....

Warning: session_start() [fu

Date help - fetch dates for Mondays between xxx and yyy?
Does anyone know the best way to do this? I have two dates, say:

2010-01-26 and 2010-05-30