Regular Expression and URL Manipulation Attacks!

The other day I was involved in fixing a bug on a page. Actually, that bug was a regression after fixing a url manipulation attack. The jscript.net line of code that caused the issue is:

str = str1.replace(/[^\w]/ig, "") ;

All this does is to check the string (part of the url) for any non-alphabetical characters and replace any such characters with empty string. To explain the regular expression:

^ denotes the negative of what follows it is equal to saying 'Not ...'

\w denotes any of the alphabets and digits

i this switch denotes the ignore case option

g this switch denotes the global replace option

Now, the expression would be self explanatory. It is searching for all characters except alphanumeric ones and replacing any such with "" irrespective of case and in the whole string.

The issue we faced is, we had certain field in query string which takes a negative value. Even the minus (-) sign infront of the value is getting replaced with empty string and the page is going for a toss. I have fixed the issue by correcting the regular expression as:

str = str1.replace(/[^\w\-]/ig, "") ;

As you can see, I have included the minus sign also in the 'Not ..' list. Not sure, if there are any other hidden issues with this.. Do you have abetter solution to tackle this issue? Do share your comments..