Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Your Answer:

Login to answer

Other forums

A little help in c#
i am doing a simple paint program using c# i want to draw with the mouse so i wrote the code of the

need a script for 3 pages
I have a customer who wants me to set up a site with a number of pages with the following requiremen

Limiting uploaded file type
Hi. First post here
I am working on a simple upload script, and I need it to limit the allowed f

How to get variable value on next page
Hello friends
i am working on payentry page ..there i have this code.........

Connect to database that isn't localhost
I am currently doing a small script for a company that doesn't have mySql support on there hosting.

Image resize
Hi again fellers

I managed to sort out the issues with the folder,

Final hurdle is th

Sending an SMS Message with ASP.NET
Often times it may be a requirement for your web application to send an SMS message. Such examples w

in php, link returns to the line
When I add a link in a php page, the link word returns to the line (as a
would do)

Examp

unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_
Can anyone view my code and tell me why im getting the error:
Parse error: syntax error, unexpect

i have no idea why this isn't working
Code: <?php
session_start();
include("connect.php");

error_reporting(E