”””

Related Codes:

search.php; line 14:

if($_POST[‘submit’]) {

$searchtext = $_POST[‘searchtext’];

$searchuser = $_POST[‘searchuser’];

if(!strstr($searchtext, ’”’Log in to see images!) {

$keywords = explode(” ”, $searchtext);

for($i = 0; $i < count($keywords); $i++) {

if($sqladdon != ””Log in to see images! {

$sqladdon .= ” AND p.message LIKE ’%$keywords[$i]%’”;

} else {

$sqladdon .= “p.message LIKE ’%$keywords[$i]%’”;

}

}

} else {

$phrase = trim(stripslashes(strstr($searchtext, ’”’Log in to see images!));

$quotesarr = explode(’”’, $phrase);

$quotes = count($quotesarr);

$phrasecount = $quotes – (count(explode(’” ”’, $phrase)) + 1);

for($i = 0; $i < $quotes; $i++) {

if($i != 0 && $i != $quotes – 1) {

if($phraseoff != “yes”Log in to see images! {

$phraselist .= ”$quotesarr[$i]|”;

$phraseoff = “yes”;

} else {

$phraseoff = “no”;

}

}

}

$phrasearr = explode(”|”, $phraselist);

$phrases = count($phrasearr) – 1;

for($i = 0; $i < $phrases; $i++) {

if($sqladdon != ””Log in to see images! {

$sqladdon .= ” AND p.message LIKE ’%$phrasearr[$i]%’”;

} else {

$sqladdon .= “p.message LIKE ’%$phrasearr[$i]%’”;

}

}

$newsearchtxt = trim(str_replace(”$phrase”, ””, stripslashes($searchtext)));

if($newsearchtxt != ””Log in to see images! {

$keywords = explode(” ”, $newsearchtxt);

}

for($i = 0; $i < count($keywords); $i++) {

if($sqladdon != ””Log in to see images! {

$sqladdon .= ” AND p.message LIKE ’%$keywords[$i]%’”;

} else {

$sqladdon .= “p.message LIKE ’%$keywords[$i]%’”;

}

}

}

if($searchuser != ””Log in to see images! {

if($sqladdon != ””Log in to see images! {

$sqladdon .= ” AND p.author LIKE ’%$searchuser%’”;

} else {

$sqladdon .= “p.author LIKE ’%$searchuser%’”;

}

}

if($sqladdon != ”” ) {

search_header();

$ttnum = 1; // Now the Vulnerable Query =)

$query = mysql_query(“SELECT t.*, f.name AS forum FROM $db_post p, $db_topic t, $db_forum f WHERE $sqladdon AND t.tid=p.tid AND f.fid=t.fid”Log in to see images! or die(mysql_error());

”””