[Kyoshokid]

Originally Posted by ZERO <ibis>

What would I need to edit to support usernames with <> for example?

I think that htmlspecialchars() needs to be in here somewhere but I do not know where it needs to go.

Note that by adding in htmlspecialchars() it should also reduce the odds that this script can be exploited.

Fixed:

Replace:
$goo=$db->query_read_slave("SELECT userid from ". TABLE_PREFIX ."user where username='".$_POST['giftname']."'");

With:
$sqlname = htmlspecialchars($_POST['giftname']);
$goo=$db->query_read_slave("SELECT userid from ". TABLE_PREFIX ."user where username='".$sqlname."'");

@op I just wanted to say thanks for this, my users are very happy with this mod.

@Zero this helped as i have a lot of users with weird names.

Working on vb4.1.0