[Sarteck]

One thing I do (though it doesn't really "protect" anything, it can help) is use the sprintf() function when building my SQL queries.

For example, if you have a PHP line line this:

PHP Code:

$query = "SELECT * FROM user WHERE userid=$userid"; 


Then, depending on what goes into $userid you might possibly be vulnerable. However, if you re-write the query like this, instead:

PHP Code:

$query = sprintf("SELECT * FROM user WHERE userid=%d",$userid); 


Then the %d can only be replaced by a number.

As Disasterpiece mentioned, make sure to sanitize all variables that might be used in queries. In fact, it's a good idea to sanitize EVERYTHING except for the ['do'] variables, for the most part.

Use $MyVar = $vbulletin->input->clean_gpc('p', 'MyVar', TYPE_INT); instead of $MyVar = $_POST['MyVar'];, for example.