[Attilitus]

Originally Posted by Floris

how come when you enter as status
"this+that=banana"

it shows as "this+that"

and =banana gets filtered out

same with : '); "); echo "banana";
ending up : "); "; echo "banana" ;;;

it rewrites quite a bit, put in other invalid code and it just ends up with 404 page not found errors, etc.

Is everything properly sanitized?

Preventing SQL exploits is built into my DB abstraction class. You might find strange behavior, but none of it is exploitable. If I remember correctly, the status messages are transmitted as a GET parameter, so there is some encoding/decoding process that is likely the cause of the strange behavior you are observing. I coded this quite awhile ago, so my memory is fuzzy.