Sanitize contact form user input

14 Jan 2012, 5:36 PM

#1

New Zenner

Join Date:: Apr 2009
Posts:: 85
Plugin Contributions:: 0

Sanitize contact form user input

I am using version 1.3.8a, and our site just failed the PCI compliance test that happens every 3 months.

They say the issue is "It appears that the cross-site scripting is flagging because the email section of the contact form is not sanitizing user input. Our code is being returned in full from that field. Please request your web developer to properly sanitize user input for this field."

Anyone know the easiest way to sanitize user input on the contact form?

Thanks much!

14 Jan 2012, 6:25 PM

#2

Kim

Obaa-san

Join Date:: Jun 2003
Location:: West Coast, North America
Posts:: 26,611
Plugin Contributions:: 0

Re: Sanitize contact form user input

You need to upgrade ASAP. That version has known vulnerabilities

14 Jan 2012, 8:03 PM

#3

betheone

New Zenner

Join Date:: Apr 2009
Posts:: 85
Plugin Contributions:: 0

Re: Sanitize contact form user input

Is the upgrade easy to do myself?

14 Jan 2012, 8:09 PM

#4

rescoccc

Totally Zenned

Join Date:: May 2010
Location:: WA State
Posts:: 1,700
Plugin Contributions:: 2

Re: Sanitize contact form user input

Upgrade tutorial:

https://www.zen-cart.com/tutorials/index.php?article=98

17 Jan 2012, 7:33 AM

#5

betheone

New Zenner

Join Date:: Apr 2009
Posts:: 85
Plugin Contributions:: 0

Re: Sanitize contact form user input

This looks quite complex. Is it something you think I should be able to do on my own? I'm somewhat web savvy but I did not do the original install of zencart.

17 Jan 2012, 2:33 PM

#6

gjh42

Black Belt

Join Date:: Jul 2005
Location:: Upstate NY
Posts:: 21,876
Plugin Contributions:: 8

Re: Sanitize contact form user input

That depends largely on how much customization your site has, and whether it was done properly using the template/override system. You do need to be able to follow instructions correctly.