Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

Contents of variable not echoing
Hey guys, hopefully this is an easy one...

In this line, the variables are not echoing out. T

Give me all your tricks for minimizing jar file size

Hi, I'm coming close to releasing my J2ME game... I am kicking up against the 64k size barrier w

shift numbers with paging
Hi

How would i be able to display 10 numbers 1 2 3 4 5 6 7 8 9 10
and when I click next

Word filter problem
Hello,

im trying to make a filter for words inputted in to my website but i want to store the

Windows 7
Windows 7 default user account control worries experts. Corporate IT departments should be pleased w

Help! refer to a friend script with captcha code
Hi guys, I am posting on here in desperate need for some help with an ongoing search I have been doi

Creating a db with a query
Hello everyone.
I'm having troubles creating a db with a query.
I'm reading a book called PHP

Creation of Raw Exposure manually
SAP Gurus

I am creating Raw Exposure ( Hedge management ) thru T Code TEM10 with followin

Windows Authentication
I have a website which is windows authenticated.
now i want something more on this application.<

Varible in trigger - refering to correct schema
Hello

Im having some issues with my trigger.
What I want to do is call opon a differ