Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

strptime() equivalent for php4 ?!
Greetings!

this is my first post, thank you in advance for your replies.

Well, the ti

redirect standard error and assert (how to?)
How do you redirect standard error and assert?

---

(Why? I am creating an web app and

Multi image upload
I have a gallery to build and want to build a dynamic upload form to allow for $var number of fields

query help
Hi experts.

i have a table rep2 like this
PROD_COD ACCT_NO DUE_DAYS BALANCE

How to insert random unique values in 2 columns ?
I have table with 2 columns

Create Table code_for_code (
first_code varchar2(10) uni

What's best way to get a user's Word doc converted to simple html and images?
Hi all,

I was just wondering if anybody has any experience of this.
Basically, I'm buildin

Stats of viewers
Hello. I have a website in php and people can login. I want to make an admin control panel where u c

DELETE rows based on content
I have a link in my rows

$bit="http://bit.ly/abcd";
$query = mysql_query("D

What is SAP Avatar ?
Hi All,

This G.Satish , my boss asked me to explore on SAP Avatar. I searced in internet

MASS PM
Hello all, I'm trying to send mass private messages to users in my database but keep getting an erro

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash