Originally posted by ExKay

---

I can give you the latest version, if you don't mind a horribly (in)complete version that still has a lot of misplaced floating code.

---

Originally posted by mvent2

---

No need for that thepass at all. Replace
if($_POST[action]=='saveprofile'){
with
if($_POST[action]=='saveprofile' && $isadmin){
and that provides the same level of protection.

---

Originally posted by mvent2

---

No need for that thepass at all. Replace
if($_POST[action]=='saveprofile'){
with
if($_POST[action]=='saveprofile' && $isadmin){
and that provides the same level of protection.

---

Originally posted by smwedit

---

this is similar to what I use and it works

to prevent basic sql injection:
in edituser.php, find:
$birthday=mktime(0,0,0,$bmonth,$bday,$byear);
add above it:
$numposts = intval($numposts);
$pemail = intval($pemail);
$powerlevel = intval($powerlevel);
$posttool = intval($posttool);
$useranks = intval($useranks);
$userid = intval($userid);
$postsperpage = intval($postsperpage);
$threadsperpage = intval($postsperpage);
$timezone = intval($timezone);
$icq = intval($icq);
$sex = intval($sex);
and to prevent auto submitting:
find:
$inph=userid VALUE=$id>
add above or under it:
$inph=thepass VALUE='$loguser[password]'>
and find:
if($_POST[action]=='saveprofile'){
change it to:
if($_POST[action]=='saveprofile' and $thepass==$loguser[password]){

---