[Spinball]

Cyricx,
do you see

PHP Code:

$formtitle 


in the following bit of the hack where it inserts the thread?

PHP Code:

                    $DB_site->query("
INSERT INTO " . TABLE_PREFIX . "thread(title, lastpost, forumid, open, replycount,
postusername, postuserid, lastposter, dateline, iconid, visible, attach)
VALUES ('".addslashes(htmlspecialchars($bbuserinfo[username]))." $formtitle', " . TIMENOW . ", $formforumid,1, 0, '" . addslashes($bbuserinfo['username']) . "', $bbuserinfo[userid],
'" . addslashes($bbuserinfo['username']) . "', " . TIMENOW . ", 0, 1,
0)
"); 


well if you put

PHP Code:

" . addslashes($formtitle) . " 


instead, this will fix it.
Try it and see if it still breaks when you use a quote in the title.