Any ideas how to fix it so that "special" names work?
For example: <[X]> will not work as an accepted username.
What do I need to edit in order for this mod to support special characters?
Fixed:
Replace:
$goo=$db->query_read_slave("SELECT userid from ". TABLE_PREFIX ."user where username='".$_POST['giftname']."'");
With:
$sqlname = htmlspecialchars($_POST['giftname']);
$goo=$db->query_read_slave("SELECT userid from ". TABLE_PREFIX ."user where username='".$sqlname."'");
|