Securing a user input - need some confirmation

Posted on 16th Feb 2014 07:03 pm by admin

Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of the problems is that there are a few security issues floating around.

I have a search box which was originally unprotected against XSS, I was easily able to execute JavaScript and force the system to echo out HTML *holds head in hands*.

I am using this code:

$term=preg_replace('/[^a-zA-Z0-9s]/', "", $term);

...to remove any non-alphanumeric characters (excluding spaces), I am thinking because this will strip out any characters like ', ", <, >, /, = etc, it should make my script safe again.

Can you confirm this, or is there something that I am missing?


Many thanks

Other php-forum

fwrite error
Hi All,
Does anyone know what is causing the error in this code?

Code: <?
$error

SWF image using php?
Hello once again.

My latest en devour requires me to produce an image of a static .swf that i

User feedback after MySQL query has been executed
Hi all, I've just registered on PHPFreaks because I've got a question that I simply can't work out b

PHP4 to PHP5 Conversion
Hi Everyone,

I am working on a site that is built up on PHP4 and each page is being started f

Please help understand this code
I noticed the index page on my site was modified this morning and found this code inserted at the bo

re calling a function without including file
Hi,
i am new to programming in php, i was just checking the wordpress code and found out in the w

Request-URI Too Large
I have created a simple submit form for a mysql database that puts a piece of code into database.<

simple ping code
been searchin the site/web and found code thats simple but doesnt work.

I have a personal we

CHECH A STRING FOR ' " ' (DOUBLE QUOTES)
I am checking for delimiter (.!?) and if there is a " after a sentence then it should neglect a

Access website from only 1 computer...?
One of my customers wants his website to only be accessed by people in which they bought the website