[Darkwaltz4]

Yes, ALL input from every location is throughly cleaned before it is ever displayed or put into the database. Most of it uses the built-in cleaning capabilities of vbulletin (which is what they are there for, and many times a hack that was removed due to exploitations is because they failed to do this).

This protects it even from remotely created and executed mock pages designed to evade many frontend validations such as html attributes and javascript. #1 rule for security is never trust anything that you output, always validate it again on the side you have control over No variable is used unless my script was the one to define it in the same scope.