[andrefedalto]

Originally Posted by Turbosport

There is a security hole in this guys:

You can inject SQL as the $_POST variables here and further down in the script.

	$db->query_write("INSERT INTO " . TABLE_PREFIX . "brotator (id, name, alt, active) VALUES ('', '$fname', '$_POST[balt]', '$_POST[bact]')");

I have called the VB function to make the variables SQL safe.

this part of the script is only accessible by the forum administrators, so why would an admin inject sql codes?