[Marco van Herwaarden]

Originally Posted by Alasse

Wonderful Hack just one little thing wrong with it. If a user has an " ' " in their name (i.e Leo O'Connor, Hannah O'Brien etc.) that name won't be able to be linked to another users name.

That sounds a little confusing doesn't it? :nervous: so I'll give an tiny example.
Master: Jane
Slave: Mike O'Brien <~ won't work and brings up this error:

Database error in vBulletin 3.0.7:
 
Invalid SQL: 
		SELECT userid, username, qas
		FROM user
		WHERE username LIKE 'Mike O'Brien%'
 
mysql error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'Brien%'' at line 3
 
mysql error number: 1064

The hack works for all my other users that don't have an " ' " in their name so I know I installed everything right and it's working perfect except for that one thing. I was hoping someone could tell me how to fix this? Thanks in advance.

This means there is a potential SQL insertion vulnerability in this hack. To avoid problems everybody should edit their qas.php file and change the line:

PHP Code:

$condition = "username LIKE '$u2%'"; // search for usernames starting with 


into:

PHP Code:

$condition = "username LIKE '" . addslashes($u2) . "%'"; // search for usernames starting with 


PS Don't have this installed, so above modification is not tested.