Securing a user input - need some confirmation


Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

Did you know?Explore Trending and Topic pages for more stories like this.
I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks
No comments posted yet

Your Answer:

Login to answer
217 Like 28 Dislike
Previous forums Next forums
Other forums

Help with form post data and arrays
Hi all,

I am new to this forum... It has been awhile since i have worked with arrays, and i a

Disable Scrollbar in TableControl
Hello everbody,

please can anybody help me - outherwise i'm going to become desperate :P<

please help me... my password gets encrypted but not able to get in database
hai guys,
please help me... in the following function my password gets encrypted but no

Request.UrlReferrer
I need to make it so that a page can only be loaded when a button is clicked on a specific page. I d

PHP error. Need help urgently
Hi,

I am programming a php site and have a problem that i just cant find out how to fix. When

Multiple PHP errors when clicking a link..and..removing a ghost..
Hi - I have 2 problems with a new website - homeswapvacations.com, which I need help solving.

User feedback after MySQL query has been executed
Hi all, I've just registered on PHPFreaks because I've got a question that I simply can't work out b

php forms and database navigatio
Hello,
I'm new to php and i'd like to post the following.
I have written code to get records f

Unidentified index error in a simple form
I have been trying to make an HTML form that is handled by a PHP script. So far my attempts to get i

Problem assigning value to variable in "IF" function
Does this script makes sense? I am trying to take the value that is set to "authenticat" a

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash