[Mr Blunt]

Just a follow-up....

MarcoH64 informed me of the following:

Addslashes is depreciated in 3.5, please use $vbulletin->db->escape_string instead .... Basicly you should sanitize all 'untrusted' (ie provided by outside sources like user input) variables used in queries."

So for anyone interested or searching like I was, here's what my previous code eventually turned into.

PHP Code:

$blunt = array(
    'wasstc'      => $vbulletin->input->clean_gpc('r', 'stc', TYPE_UINT),
    'fileid'      => $vbulletin->input->clean_gpc('r', 'attachmentid', TYPE_UINT),
    'userid'      => ($vbulletin->userinfo['userid']) ? $vbulletin->userinfo['userid'] : 0,
    'username'    => ($vbulletin->userinfo['userid'] AND ($vbulletin->options['blunts_whodl_logwhat'] & $vbulletin->bf_misc['bluntswhodloptions']['logusernames'])) ? $vbulletin->userinfo['username'] : '',
    'filename'    => ($vbulletin->options['blunts_whodl_logwhat'] & $vbulletin->bf_misc['bluntswhodloptions']['logfilenames']) ? $attachmentinfo['filename'] : '',
    'dateline'    => ($vbulletin->options['blunts_whodl_logwhat'] & $vbulletin->bf_misc['bluntswhodloptions']['logdatelines']) ? TIMENOW   : 0,
    'ipaddress'   => ($vbulletin->options['blunts_whodl_logwhat'] & $vbulletin->bf_misc['bluntswhodloptions']['logipaddress']) ? IPADDRESS : '',
    'alt_ip'      => ($vbulletin->options['blunts_whodl_logwhat'] & $vbulletin->bf_misc['bluntswhodloptions']['logaltips'])    ? ALT_IP    : '',
    'logguests'   => ($vbulletin->options['blunts_whodl_logwhat'] & $vbulletin->bf_misc['bluntswhodloptions']['logguests'])    ? 1 : 0,
    'logisactive' => ($vbulletin->options['blunts_whodl_logwhat'] & $vbulletin->bf_misc['bluntswhodloptions']['logisactive'])  ? 1 : 0
);

if ((!$blunt['wasstc'] AND $blunt['fileid'] AND $blunt['logisactive']) AND ($blunt['userid'] OR $blunt['logguests']))
{
    $db->query_write("INSERT INTO " . TABLE_PREFIX . "blunts_whodownloaded_ip (userid, username, filename, fileid, ipaddress, alt_ip, dateline)
        VALUES ('" . $vbulletin->db->escape_string($blunt['userid']) . "',
            '" . $vbulletin->db->escape_string($blunt['username']) . "',
            '" . $vbulletin->db->escape_string($blunt['filename']) . "',
            '" . $vbulletin->db->escape_string($blunt['fileid']) . "',
            '" . $vbulletin->db->escape_string($blunt['ipaddress']) . "',
            '" . $vbulletin->db->escape_string($blunt['alt_ip']) . "',
            '" . $vbulletin->db->escape_string($blunt['dateline']) . "')
    ");
}
unset($blunt); 


Don't mind all the "options" stuff as that was merely spice that I added to my hack to put some on/off switches inside the AdminCP options. The relevant parts are what you see in the query where "escape_string" is used to clean the variable before insertion to the database.