[BBF]

I found a possible SQL injection (market.php?do=cat&id=1')
to fix it, replace:

PHP Code:

if ($_REQUEST['id']) {
    $id = $_REQUEST['id']; 


with:

PHP Code:

if ($_REQUEST['id']) {
    $id = intval($_REQUEST['id']); 


because it have to get only integers. (and then you won't need "addslashes").

Staff note: This is not a SQL injection vulnerability.
@BBF: Please do not post an alleged vulnerability in public, please see our Mod Exploit Guidelines