UserSystem v1.0.3

[MrCraig]

Ok,

UserSystem v1.0.3 has now been released and as well as cleaning up some vars better, its also loaded with some new features including VIP management, send furni, profiles, memberlist etc etc etc

I've replaced htmlspecialchars with a clean function

<?php
function clean($str)
{
$st = strip_tags(addslashes(stripslashes(htmlspecialchars($str))));
return $st;
}
?>

Hope thats sufficient Oo

Anyways, heres link

http://www.habbo-center.com/scripts/


Please post any feedback

[GoldenMerc]

Could you do a list of all the features?

[Puma]

any demos

[MrCraig]

Could you do a list of all the features?

theyrs a full list of features on the download page

any demos

Nope, havent got a demo set up yet due to all the CMS'y aspects of the script.

[Sunny.]

Any demo available?

Edit: okay, if anyone sets it up please do post Thanks

[Tomm]

Grr! Tis still unsecure.

You should use:

http://www.php.net/mysql_real_escape_string
"Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks."

Plus why strip and add slashes again? If you are concerned that it is already stripped using magic quotes then just check magic_quotes_gpc to see if it is enabled...

[GoldenMerc]

Here are the features:

Some Features of the system include:
- Furni System
- PM System
- Badge System
- Credits System
- Automated VIP System
- Mini-CMS
- Easy to use admin options
- Easy to use installer
- Only need to edit ONE file.

[MrCraig]

Grr! Tis still unsecure.

You should use:

http://www.php.net/mysql_real_escape_string
"Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks."

Plus why strip and add slashes again? If you are concerned that it is already stripped using magic quotes then just check magic_quotes_gpc to see if it is enabled...

magicquotes is enabled..

[Tomm]

Errm.. magic quotes is dependant on the PHP configuration so unless you have magic powers to decide that people who run your usersystem has magic quotes enabled you should check first.

Also please review the link about mysql_real_escape_string as if the end user's server runs a different char set to the default one then you could be exposing them to SQL injection.

magicquotes is enabled..

[headboard]

HabboStation.net/user1
u: admin
p: admin

demo :]