[okgaz]

I've got the same error + it has completely disabled the arcade.

It's not that the username has changed it's that it contains an apostrophe ( ' ). Could people use this to inject code? I think the solution is to correctly escape the username using:

http://uk2.php.net/mysql_escape_string
or
http://uk2.php.net/manual/en/functio...ape-string.php

I just searched through all of the PHP files to find out where this query is called and it is:

mod_arcade.php line 276

I'm not an expert on this, does anybody know if it is a security issue as well as it taking the arcade down? Can someone who knows what they are doing patch up the code?

--------------- Added at 14:00 ---------------

Here is a quick fix I have made that stops the error coming up. I'm not sure if there are other problems with usernames with apostrophes that need to be addressed though.

In arcade/modules/mod_arcade.php
Above:

PHP Code:

$sendername    = $notify['creat']; 


On line 268 add:

PHP Code:

$notify['creat'] = mysql_real_escape_string($notify['creat']);