Securing against SQL Injection?

[Disasterpiece]

Don't use vars in query-context which can be altered by the user in any way without sanitizing.
This includes $_GET, $_POST, $_COOKIE vars, as well as data which can be loaded from the database.

run $vbulletin->db->escape_string($myVar) on anything and you can be pretty sure that this won't be injected.

//e:

btw, it's a php-related issue and has not really anything to do with vbulletin or the vbulletin version.