Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

pass form variables straight to email, no database required?
hello all,

im working on this form...

http://www.adobedayevents.com/project_request/pr

Delete records not in top 15
Hi,

I'm creating a hall of fame page in my game and the page will only display the top 15 sco

What's best way to get a user's Word doc converted to simple html and images?
Hi all,

I was just wondering if anybody has any experience of this.
Basically, I'm buildin

Captcha problem users just refresh and it will let them auto submit again
Users will just re submit and not have to enter the new captcha.. ? Lol but if i refresh the page, t

include function being weird?
I have a very simple system to grab an IP outputted by a PHP file.. (for a project I have) but it ou

Require select-option functionality in Module Pool Programming
Hi Gurus,

I am doing a development by Module Pool on Warehouse Management. For that devel

simple script won't work. Please help
I'm new to php, and I am having trouble displaying a simple script in my web browser. My php code ex

insert Multiple rows into the table from that table data
Hi All,

I have a requirement like to insert mulitple rows into the table from that

help with variable
I've got a problem, i want to echo some images depending on the $id, however for me to get that id i

Calculus Help (and by help I mean homework)
Hrmmm, I hate posting about math homework, partly because it's homework, and partly because I hate w

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash