[Soup]

In the Warning System (v3.1.9) in Warn.php, on line 332 you are running a potentially unsafe query (for example if a user enters a non-numerical input as the id variable). If you enter a string that doesn't start with a number (such as "foo") as the id the code will catch the problem on line 328-330, however if the string entered starts with a number (such as "3foo") then it will pass through the check fine.

In order to fix this:

Before line 328-330 add:

PHP Code:

$_GET['id'] = intval($_GET['id']); 


or globalize the variable:

PHP Code:

globalize($_GET,array('id' => INT)); 


and then you use $id instead of $_GET['id'].