Is it possible to disallow certain characters in the search bar in Magento

We are getting a few searches of what looks like a Mysql attack using characters like "$().// etc


You can do it like below. Go to your form.mini.phtml file in


Add below javasctipt function in your file.

function validate() {
    var element = document.getElementById('search');
    element.value = element.value.replace(/[^a-zA-Z0-9@]+/, '');

Now add onkeyup="validate();" in your textbox like below.

<input onkeyup="validate();" id="search" type="text" 
name="<?php echo $catalogSearchHelper->getQueryParamName() ?>" 
value="<?php echo $catalogSearchHelper->getEscapedQueryText() ?>" 
maxlength="<?php echo $catalogSearchHelper->getMaxQueryLength();?>" />
  • Thanks, I got it to work on development site.. I changed "var element = document.getElementById('input-field');" to "var element = document.getElementById('search');" Is this still correct? – Callam Warner-Billington Aug 23 '17 at 9:18
  • @CallamWarner-Billington, Thanks. It was a typo mistake. I have updated the code. – Yogesh Trivedi Aug 23 '17 at 10:19
  • Didn't work, the search terms are still coming through? i.cubeupload.com/Ub8OrV.png – Callam Warner-Billington Aug 24 '17 at 13:36
  • Can you check by enabling template path hints if the file which you edited is the correct file? Also have you refreshed your cache? – Yogesh Trivedi Aug 25 '17 at 3:59
  • I've just flushed the cache and the file i edited is located: app\design\frontend\default\ma_kidstore\template\catalogsearch - I've cleared all search terms so will update if they come through again. – Callam Warner-Billington Aug 25 '17 at 8:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.