Fixed a high risk vulnerability (SQL injection).
Fixed a bug in the newpoints_addpoints function which wouldn't add/remove points from a user if points had been added/removed in the same page already.