Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

mail() says sent but no email received
My code is quite simple:

Code: <?php
$to = "Ty44ler@yahoo.com";
$subje

PHP mail() rejected by SMTP
I'm currently working on a newsletter application which is installed on a windows 2003 server runnin

mail()
Hi all. I have a problem with emails. I am trying to set up a mail system where customers can subscr

PHP and XML image gallery variable issue
I'm trying to display the large image on the same page as the thumbnails, to do that I'm passing a v

IF Statement & Two Tables With Different Echoes
I'm retrieving two tables in a single query using UNION ALL, like so:

Code: $query = "SE

RSS poster script?
I have found a script that posts RSS's for me on a site that I'm building. However I would like to a

Posting Serialized Data Not Working
I am trying to send an object from one PHP file to another using POST. I serialize the object and th

array_diff weirdness
I'm using the following bit of code

$diff = array_diff($pids, $pidlist);
$diff = array_va

RFQ Configuration - can you make PLANT field an optional field in ME42
Is there a way to make the plant field on an RFQ optional in change mode (ME42)?

parse error
Parse error: syntax error, unexpected '[', expecting ')' in /Users/admin/Sites/phptest/array.php on

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash