[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Critical SQL Injection PHPNuke <= 7.8 - Your_Account module



In my index.php I have this code:

function confirmNewUser($username, $user_email, $user_password, $user_password2, $random_num, $gfx_check) {
	global $stop, $EditedMessage, $sitename, $module_name, $minpass;
	include("header.php");
	include("config.php");
	$username = substr(htmlspecialchars(str_replace("\'", "'", trim($username))), 0, 25);
	$username = rtrim($username, "\\");	
	$username = str_replace("'", "\'", $username);
	$user_email = filter($user_email, "nohtml");
	$user_viewemail = "0";
	userCheck($username, $user_email);
	$user_email = validate_mail($user_email);
	$user_password = htmlspecialchars(stripslashes($user_password));
	$user_password2 = htmlspecialchars(stripslashes($user_password2));

I think this SQL Injection don´t work in my site. That´t right?