[BrettC Frontier]

Minor bug found...

- Username input is not being fully sanitized. Input does not encode/escape special characters or non-alphanumeric characters such as ' " ` and so forth. The ' and " on input especially makes vBulletin unhappy, and throws SQL errors to the user and to the email configured for forum admins.

Invalid SQL:

UPDATE vb_user
SET username = 'New'userName'
WHERE username = 'CurrentUserName';

MySQL Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'userName'
WHERE username = 'CurrentUserName'' at line 2
Error Number : 1064