[LBmtb]

Found a small bug today. I got this email about a db error from chatbox:

Database error in vBulletin 3.6.4:

Invalid SQL:
INSERT INTO vb_chatbox (userid, username, shout, dateline, ipaddress)
VALUES (1030, '26'er Zen Master', 'Sart Kicked ASS Today', 1175478886, '66.74.144.57');

It was due to the single quote in the user's name. Here's the fix:

FIND: (was on line 47 for me)

	$db->query_write("INSERT INTO ".TABLE_PREFIX.$chatbox_table." (userid, username, shout, dateline, ipaddress) 
VALUES (".$vbulletin->userinfo['userid'].", '".$db->escape_string($vbulletin->userinfo['username'])."', '".$db->escape_string($_POST['shout'])."', ".TIMENOW.", '".$db->escape_string(IPADDRESS)."')");

REPLACE WITH:

	$db->query_write(htmlentities("INSERT INTO ".TABLE_PREFIX.$shoutstable." (userid, username, shout, dateline, ipaddress) 
VALUES (".$vbulletin->userinfo['userid'].", '".$vbulletin->userinfo['username']."', '".$db->escape_string($_POST['shout'])."', ".TIMENOW.", '".$db->escape_string(IPADDRESS)."')"));

This will sanitize the query a bit more before it gets run on the database.