I'm thinking of a hack..

[Velocd]

..that I need your opinion on, and what vulnerabilities it could possibly cause for the forum.

This hack will create a new large profile field similar to the signature field in the user-profile page. There a user will allow to enter all the web authoring code they want (assume there is no block of which languages they could use), and then this code is stored in the user table as a new column of data, called "custompage".

I create a new template, inside the template I place $headinclude, $header, and $footer. Between the $header and $footer I place this variable: $custompage

$custompage referes to all the data that the user inputted into their field.

Initially, by a link in each users profile, which will look something like: http://www.mysite.com/forums/member.php?s=$session[sessionhash]&action=getcustompage&userid=$userinfo[userid], the member will be sent to a new page that contains all the content they entered in their custompage field. Ofcourse this content will be translated into weblanguage code, and thus displaying that users custom page!

Sounds cool, right? Well now I know the uses of HTML on the forum are bad enough for vulnerabilities, so what serious problems would occur allowing this?

What comes to my mind ofcourse is malicious users making PHP queries in the field and corrupting my database! Totally possible from my point of view. Other things include calling variables from the global.php, since it is being referenced in members.php, and also calling other variables from members.php.

So..to prevent these things, disabling (ofcourse) PHP and other non-HTMl/Javascript languages would probably be a very high priority. As for HTML and javacript itself though, what problems can occur?

Any help on this would be great!

Regards,
Velocd