If you try to register with an apostrophe, you get a DB error because it breaks the MySQL query. You also can't administer a user account with an apostrophe in it. vB should ban it by default, or take this into account, but apparently they don't.
I used the regex to only allow letters, numbers and spaces, but the problem now is that if you use something other than those, it doesn't tell you that's why you get an error, it says "that username already exists", which isn't true.
If you get a SQL-error on a username with an apostrophe, then i would quickly uninstall my modifications, as you have installed a modification that is potentially open for SQL-injections.
03-05-2007, 05:23 AM
Threaded Mode