[MaryTheG(r)eek]

Originally Posted by thincom2000

missing $db->escape_string?

I don't think so, as this is just a few lines before. Actually the problem is why this email has been accepted. I also added this function in the cron, just for an additional security check, but the problem is before, during record's save.

I seen again the code, and seems to me correct:

    $vbulletin->input->clean_array_gpc('p', array(
        'subscriberid'  => TYPE_INT,
        'groupid'       => TYPE_INT,
  'email'      => TYPE_STR
 ));
    // Get Values
    $subscriberid = $vbulletin->GPC['subscriberid'];
    $groupid = $vbulletin->GPC['groupid'];
 $email = $db->escape_string($vbulletin->GPC['email']);
    if($subscriberid != 0)
    {
       if(is_valid_email($email))
       {
          $vbulletin->db->query_write("UPDATE " . TABLE_PREFIX . "micronewsletter_subscribers
                                       SET groupid = '$groupid',
                                           email = '$email' WHERE id=$subscriberid");
       } else {
         $vbulletin->url="newsletter.php?" . $vbulletin->session->vars['sessionurl'] . "do=main&tab=5";
         eval(print_standard_redirect('micronewsletter_invalid_email', true, true));
       }
    } else {
       if(is_valid_email($email))
       {

First I'm escaping the string and then I'm checking for valid email address. The only that maybe is wrong, is if it needs something else than "TYPE_STR". Is there "TYPE_EMAIL" ??

Maria