escape the cname for the shell exec
escape the $user variable coming from $_REQUEST
magic_quote_gpc makes this not exploitable, but we should move away from that sooner or later
escape the $name, $email, $username and $note variables coming from $_REQUEST
magic_quote_gpc makes this not exploitable, but we should move away from that sooner or later
$user was renamed to $cuser in include/login.inc in c659097ec0d0a08327b80c1b32ac0797f35ba5dd
introduce a whitelist for the order param
escape the $search variable coming from $_REQUEST
magic_quote_gpc makes this not exploitable, but we should move away from that sooner or later
actualize the db schema based on the current production status
escape the variables coming from $_REQUEST
magic_quote_gpc makes this not exploitable, but we should move away from that sooner or later
$user was renamed to $cuser in include/login.inc in c659097ec0d0a08327b80c1b32ac0797f35ba5dd
also fix the column names
escape the variables coming from $_REQUEST
magic_quote_gpc makes this not exploitable, but we should move away from that sooner or later
enforce types for numeric vars