[sv1cec]

Originally Posted by pimpery

aghhh! injection? in a premium modification? >.<
Example:
Warn.php?&do=ViewWarnings&id=1/

Input isnt escaped before being put into the sql query. Seriously, what the ****. A premium modification that doesn't even check the input

I made a Fix:
open warn.php

find:

// #######################################################################
// ######################## START MAIN SCRIPT ############################
// #######################################################################

Below that insert:

//SQL-safe modification
function safescape($key,&$value){
$value = mysql_escape_string($value);
}
$func = 'safescape';
array_walk(&$_GET,$func);
array_walk(&$_POST,$func);
//SQL safety mod done

Could you please elaborate? I am not sure I follow you.