IMPORTANT SECURTY FIX

Joined: 16 Jan 2006 Posts: 2

Well i pm u this but since you dont read your PMs. I found this in your Rules.
. Do not Send the admin Pm's cos he wont read them.
Done.
So here is a problem I found with your website.
As you can see you have left your self wide open for hacker attacks.
I will be nice and edit your password here.
But if you are going to edit someones tempplate you might want to read it before you install it LMAO Good Luck
<?php
//=========== FragFrog's MU WebCenter =================
// Welcome to FrogMu's WebCenter, originally based on
// IO*'s files and editted and modified by FragFrog
//=========== FragFrog's Mu WebCenter =================

//============== USER EDITABLE AREA ===================

//============ IP AND LOGIN SETTINGS ==================
// Enter the IP or DSN of the database server to connect to
// Change to your server IP (if remote only). Usually it
// should be 127.0.0.1
$xa = getenv('REMOTE_ADDR');
$badwords = array(";","'",""","*","union","del","DEL","insert","update","drop","sele","$");

foreach($_POST as $value)
foreach($badwords as $word)
if(substr_count($value, $word) > 0)
die("Security Warning!<br />Forbidden simbols are included, please remove them and try again -> $xa");

$dbhost = "localhost";

// Enter the username to connect to the db, default is sa
$dbuser = "*****";

// Enter the password for your SQL Server (this is the
// password you entered when you installed the MSSQL server)
$dbpasswd = "#####12001";

// Host. IP If working remotely, usually 127.0.0.1 works
$host = "localhost";

// Gameserver port, used for the online/offline status check
// on frontpage, default is 55901
$port = "55901";

//================ WEBSITE SETTINGS ==================

// Select type of reset: options are 'items', 'points' and 'none'
// - Items means user can select excelent armor or wing set
// - points means user loses all his points and gets given a certain
// amount of new points freely to distribute
// - none means user keeps all his points but doesn't get an item.

// Website title. Enter something that'll be above every page.
$title= "Welcome to Chaos-Mu By XD-DRAGON!";

// The Admin e-mail adres:
$gm_mail = 'admin@freshserv.net';

//=============== NOT EDITABLE AREA ====================
// DEFAULT SETTINGS DO NOT CHANGE UNLESS YOURE VERY SURE
// YOU KNOW WHAT YOURE DOING!
$alogin = $dbuser;
$apass = $dbpasswd;
$db = 'MuOnline';
$regsubmit = "regform.submit()";
$msconnect=mssql_connect("$host","$alogin","$apass");
$msdb=mssql_select_db("$db",$msconnect);
$ip = $host;
?>