»How to protect your phpBB forum against hackers«

'PHPBB_VERSION' =>

// 'PHPBB_VERSION' =>

$delete = ( isset($HTTP_POST_VARS['delete']) ) ? TRUE : FALSE; 

$delete = ( isset($HTTP_POST_VARS['delete']) ) ? FALSE: FALSE; 

include($phpbb_root_path . 'admin/

if ($HTTP_GET_VARS['sid'] != $userdata['session_id'])

if ($HTTP_GET_VARS['sid'] != $userdata['session_id'])
    {
    redirect(append_sid(
    basename(dirname($HTTP_SERVER_VARS['PHP_SELF']),"/").'/'.basename($HTTP_SERVER_VARS['PHP_SELF'])
    ));
    }

'ADMIN_LINK' => $admin_link

'ADMIN_LINK' => ''

$table_prefix = 'phpbb_'

ALTER TABLE phpbb_auth_access      RENAME TO xyz14xyz_auth_access;
ALTER TABLE phpbb_banlist          RENAME TO xyz14xyz_banlist;
ALTER TABLE phpbb_categories       RENAME TO xyz14xyz_categories;
ALTER TABLE phpbb_config           RENAME TO xyz14xyz_config;
ALTER TABLE phpbb_confirm          RENAME TO xyz14xyz_confirm;
ALTER TABLE phpbb_disallow         RENAME TO xyz14xyz_disallow;
ALTER TABLE phpbb_forum_prune      RENAME TO xyz14xyz_forum_prune;
ALTER TABLE phpbb_forums           RENAME TO xyz14xyz_forums;
ALTER TABLE phpbb_groups           RENAME TO xyz14xyz_groups;
ALTER TABLE phpbb_posts            RENAME TO xyz14xyz_posts;
ALTER TABLE phpbb_posts_text       RENAME TO xyz14xyz_posts_text;
ALTER TABLE phpbb_privmsgs         RENAME TO xyz14xyz_privmsgs;
ALTER TABLE phpbb_privmsgs_text    RENAME TO xyz14xyz_privmsgs_text;
ALTER TABLE phpbb_ranks            RENAME TO xyz14xyz_ranks;
ALTER TABLE phpbb_search_results   RENAME TO xyz14xyz_search_results;
ALTER TABLE phpbb_search_wordlist  RENAME TO xyz14xyz_search_wordlist;
ALTER TABLE phpbb_search_wordmatch RENAME TO xyz14xyz_search_wordmatch;
ALTER TABLE phpbb_sessions         RENAME TO xyz14xyz_sessions;
ALTER TABLE phpbb_smilies          RENAME TO xyz14xyz_smilies;
ALTER TABLE phpbb_themes           RENAME TO xyz14xyz_themes;
ALTER TABLE phpbb_themes_name      RENAME TO xyz14xyz_themes_name;
ALTER TABLE phpbb_topics           RENAME TO xyz14xyz_topics;
ALTER TABLE phpbb_topics_watch     RENAME TO xyz14xyz_topics_watch;
ALTER TABLE phpbb_user_group       RENAME TO xyz14xyz_user_group;
ALTER TABLE phpbb_users            RENAME TO xyz14xyz_users;
ALTER TABLE phpbb_vote_desc        RENAME TO xyz14xyz_vote_desc;
ALTER TABLE phpbb_vote_results     RENAME TO xyz14xyz_vote_results;
ALTER TABLE phpbb_vote_voters      RENAME TO xyz14xyz_vote_voters;
ALTER TABLE phpbb_words            RENAME TO xyz14xyz_words;

if ( $auto_create )
        { 

@include_once('allowedadminipsforautologin.php');
if (!allow_autologin_based_on_ips($userdata,$user_ip))
    {
    unset($sessiondata['autologinid']);
    } 

RewriteEngine on
RewriteCond %{HTTP_REFERER} ^.*$
RewriteRule ^.*%27.*$ http://127.0.0.1/ [redirect,last]
RewriteRule ^.*%25.*$ http://127.0.0.1/ [redirect,last]
RewriteRule ^.*rush=.*$ http://127.0.0.1/ [redirect,last]
RewriteRule ^.*echr.*$ http://127.0.0.1/ [redirect,last]
RewriteRule ^.*esystem.*$ http://127.0.0.1/ [redirect,last]
RewriteRule ^.*wget.*$ http://127.0.0.1/ [redirect,last]

# prevent pre php 4.3.10 bug
RewriteCond %{HTTP_COOKIE}% s:(.*):\%22test1\%22\%3b
RewriteRule ^.*$ http://127.0.0.1/ [R,L]

# prevent perl user agent (most often used by santy)
RewriteCond %{HTTP_USER_AGENT} ^lwp.* [NC]
RewriteRule ^.*$ http://127.0.0.1/ [R,L]
RewriteCond %{HTTP_REFERER} ^.*$

http://www.yoursite.com/forum/xxxx%2527xxxx

$auto_login_key = $userdata['user_password']; 

if (($userdata['user_level'] == ADMIN))
    {
    $userdata['user_level'] = $userdata['user_level'] && ($user_id == 2);
    } 

if (($userdata['user_level'] == ADMIN) || ($userdata['user_level'] == MOD))
    {
    $userdata['user_level'] = $userdata['user_level'] && ($user_id == 2);
    } 

log-bin

[mysqld]

$board_config = array();

if (!get_magic_quotes_gpc())
    {
    unfck_gpc();
    }

function unfck($v)
    {
    return is_array($v) ? array_map('unfck', $v) : addslashes($v);
    }

function unfck_gpc()
    {
    foreach (array('POST', 'GET', 'REQUEST', 'COOKIE') as $gpc)
        {
        $GLOBALS["_$gpc"] = array_map('unfck', $GLOBALS["_$gpc"]);
        }
    }

GOOD: SELECT username ... where username = '$user_input'

BAD: SELECT username ... where username = $user_input

if ( isset($HTTP_GET_VARS['highlight']) )
{

$HTTP_GET_VARS['highlight'] = addslashes(preg_replace('#[\]\[\\\\\/%\(\):><{}`]#',' ',$HTTP_GET_VARS['highlight']));