[ummahforums]

Hi,

I noticed that when users have an apostrophe (this character: ' ) in their username, it causes cause SQL errors in chatlauncher.php. You just need to add slashes (using the PHP function addslashes) in the DB queries where usernames are mentioned, i.e. lines such as these:

PHP Code:

$userprofilefields=$DB_site->query("SELECT homepage
                                  FROM user
                                  WHERE username = '$bbuserinfo[username]'"); 


What I did to fix it was to add this at the start:

PHP Code:

$slashedusername = addslashes($bbuserinfo[username]); 


Next I changed the $userprofilefields line quoted above to this:

PHP Code:

$userprofilefields=$DB_site->query("SELECT homepage
                                  FROM user
                                  WHERE username = '$slashedusername'"); 


I also made use of the htmlspecialchars function so that usernames with apostrophes wouldn't mess up the HTML. So line 68 of chatlauncher.php (English version) becomes:

PHP Code:

$nickname=htmlspecialchars($bbuserinfo[username], ENT_QUOTES); 


Line 217 becomes this:

PHP Code:

$realname=htmlspecialchars($bbuserinfo[username], ENT_QUOTES); 


And finally line 206 becomes this:

PHP Code:

$applet_string = htmlspecialchars((implode(",",$buddy_names)), ENT_QUOTES); 


Similar things will have to be done for exit message etc., but this fixes the main problem for my site (as we have a few users with usernames like this: user'name).