Apostrophe and special characters in validfields?

[Dave]

The clean_gpc function of vbulletin only checks for the type of the variable. (String, integer, etc.)
Now you are vulnerable to SQL injection, you need to escape your string with something like $db->escape_string($var);