[Daisuke Niwa]

Hey! Heads up, I think I found a potential exploit that would allow for SQL Injection with the username. We encountered this error with a member who likes to use apostrophe's in their username:

Invalid SQL:
SELECT COUNT(*) AS countrows FROM tmnt_ladder_players WHERE lid='1' AND (userid='4043' OR username='.:'Xari') AND active=1;

MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Xari') AND active=1' at line 1

Luckily the user's name wasn't " justanothermember'; DROP TABLE users; -- " or similar.


Is there any way to sanitize the username input without breaking the entire mod?