Re: Critical SQL Injection PHPNuke <= 7.8 - Your_Account module

[mefuentes61@xxxxxxxxxxx]

In my index.php I have this code:

function confirmNewUser($username, $user_email, $user_password, 
$user_password2, $random_num, $gfx_check) {
        global $stop, $EditedMessage, $sitename, $module_name, $minpass;
        include("header.php");
        include("config.php");
        $username = substr(htmlspecialchars(str_replace("\'", "'", 
trim($username))), 0, 25);
        $username = rtrim($username, "\\");     
        $username = str_replace("'", "\'", $username);
        $user_email = filter($user_email, "nohtml");
        $user_viewemail = "0";
        userCheck($username, $user_email);
        $user_email = validate_mail($user_email);
        $user_password = htmlspecialchars(stripslashes($user_password));
        $user_password2 = htmlspecialchars(stripslashes($user_password2));

I think this SQL Injection don´t work in my site. That´t right?