Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

timezone change with date()
so i put all my times for posts in my made from scratch forum(not phpbb3 or sm)
in my mysql db u

Cursor statement failed with errors
Following statement failed with the errors.

cursor proj_cursor1 is (select projectID from

About imagecopyresampled()
Hello,

I am looking to use this function to resize parts of an image to a fixed thumbnail siz

Quick variable question
hey guys/gals,
im trying to write a php script and it works fine as i have it, but i need to set

Dynamically set AccordianPane Header
I have an accordian on my master page. I'd like to be able to dynamically change the header on diff

mysql select query problem
how can i select multiple fields from multiple table in one query like

i have table name t1 a

Displaying Site Logo/Icon on a Title tag
really need some help out here. I want to insert a Logo/Icon just like the one close to the "PH

Create or replace package is ending ORA-21700
Database 9.2.0., patch 8 (9.2.0.8.0).
I trying run
create or replace package ....etc.

IS Retail & Manufacturing
Hi

Can IS Retail and Manufacturing activities be done in same instance ie. in same client

Else statement screws up all css
Does anyone know what goes wrong in the process with this php code?
This code seems to be causing

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash