Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Odd or Even
Inside of a while loop I need to echo several rows of info...easy enough.

In the loop (for th

PHP form help required
Hi all! Apologies in advance for having to message the forum for help. I know you must get a lot of

Operator precedence assistance.
I did a quick Google search and couldn't quite find the answer I wanted in terms I could understand,

Get keys and values from an array
Hellow,

I have an array $Data with keys and values. With a foreach I can display all the valu

DOMDocument
Hello All,

I need to take an XML document, modify some of the nodes in it and then perform a

Help: problem with Headers to download PDF file
Hi,

I'm trying to implement a script where when a user clicks a link he gets a PDF file to op

Which practice of iteration through containers is preferred
In the "real world" what kind of loop do most people use to iterate through a container like a vecto

Displaying returned XML in another PHP page
I have an online payment form that will return XML given if a payment is successful or declines. I

problem with refreshing
in my site, i have an index page, it has a main div. this main div's content is changing according t

mysql_query returning boolean instead of mysql ressource
Hi,

I seem to have a weird issue with the php command mysql_query. I pass 2 arguments the que