Index: /trunk/admin/comments.php
===================================================================
--- /trunk/admin/comments.php	(revision 4303)
+++ /trunk/admin/comments.php	(revision 4304)
@@ -161,5 +161,5 @@
   else
   {
-    $author_name = $row['username'];
+    $author_name = stripslashes($row['username']);
   }
   $template->append(
Index: /trunk/admin/history.php
===================================================================
--- /trunk/admin/history.php	(revision 4303)
+++ /trunk/admin/history.php	(revision 4304)
@@ -260,5 +260,5 @@
     while ($row = mysql_fetch_assoc($result))
     {
-      $username_of[$row['id']] = $row['username'];
+      $username_of[$row['id']] = stripslashes($row['username']);
     }
   }
Index: /trunk/admin/include/c13y_internal.class.php
===================================================================
--- /trunk/admin/include/c13y_internal.class.php	(revision 4303)
+++ /trunk/admin/include/c13y_internal.class.php	(revision 4304)
@@ -196,5 +196,5 @@
               array(
                 'id'       => $id,
-                'username' => $name,
+                'username' => addslashes($name),
                 'password' => $password
                 ),
Index: /trunk/admin/include/functions.php
===================================================================
--- /trunk/admin/include/functions.php	(revision 4303)
+++ /trunk/admin/include/functions.php	(revision 4304)
@@ -2113,5 +2113,5 @@
   }
 
-  return $username;
+  return stripslashes($username);
 }
 
Index: /trunk/admin/include/functions_notification_by_mail.inc.php
===================================================================
--- /trunk/admin/include/functions_notification_by_mail.inc.php	(revision 4303)
+++ /trunk/admin/include/functions_notification_by_mail.inc.php	(revision 4304)
@@ -289,5 +289,5 @@
 
   $env_nbm['sent_mail_count'] += 1;
-  array_push($page['infos'], sprintf($env_nbm['msg_info'], $nbm_user['username'], $nbm_user['mail_address']));
+  array_push($page['infos'], sprintf($env_nbm['msg_info'], stripslashes($nbm_user['username']), $nbm_user['mail_address']));
 }
 
@@ -302,5 +302,5 @@
 
   $env_nbm['error_on_mail_count'] += 1;
-  array_push($page['errors'], sprintf($env_nbm['msg_error'], $nbm_user['username'], $nbm_user['mail_address']));
+  array_push($page['errors'], sprintf($env_nbm['msg_error'], stripslashes($nbm_user['username']), $nbm_user['mail_address']));
 }
 
@@ -339,5 +339,5 @@
     array
     (
-      'USERNAME' => $nbm_user['username'],
+      'USERNAME' => stripslashes($nbm_user['username']),
 
       'SEND_AS_NAME' => $env_nbm['send_as_name'],
@@ -428,5 +428,5 @@
         if (pwg_mail
             (
-              format_email($nbm_user['username'], $nbm_user['mail_address']),
+              format_email(stripslashes($nbm_user['username']), $nbm_user['mail_address']),
               array
               (
@@ -466,10 +466,10 @@
         );
         $updated_data_count += 1;
-        array_push($page['infos'], sprintf($msg_info, $nbm_user['username'], $nbm_user['mail_address']));
+        array_push($page['infos'], sprintf($msg_info, stripslashes($nbm_user['username']), $nbm_user['mail_address']));
       }
       else
       {
         $error_on_updated_data_count += 1;
-        array_push($page['errors'], sprintf($msg_error, $nbm_user['username'], $nbm_user['mail_address']));
+        array_push($page['errors'], sprintf($msg_error, stripslashes($nbm_user['username']), $nbm_user['mail_address']));
       }
 
Index: /trunk/admin/notification_by_mail.php
===================================================================
--- /trunk/admin/notification_by_mail.php	(revision 4303)
+++ /trunk/admin/notification_by_mail.php	(revision 4304)
@@ -176,5 +176,5 @@
         sprintf(
           l10n('nbm_user_x_added'),
-          $nbm_user['username'],
+          stripslashes($nbm_user['username']),
           get_email_address_as_display_text($nbm_user['mail_address'])
         )
@@ -389,5 +389,5 @@
               if (pwg_mail
                   (
-                    format_email($nbm_user['username'], $nbm_user['mail_address']),
+                    format_email(stripslashes($nbm_user['username']), $nbm_user['mail_address']),
                     array
                     (
@@ -666,5 +666,5 @@
       if (get_boolean($nbm_user['enabled']))
       {
-        $opt_true[ $nbm_user['check_key'] ] = $nbm_user['username'].'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
+        $opt_true[ $nbm_user['check_key'] ] = stripslashes($nbm_user['username']).'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
         if ((isset($_POST['falsify']) and isset($_POST['cat_true']) and in_array($nbm_user['check_key'], $_POST['cat_true'])))
         {
@@ -674,5 +674,5 @@
       else
       {
-        $opt_false[ $nbm_user['check_key'] ] = $nbm_user['username'].'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
+        $opt_false[ $nbm_user['check_key'] ] = stripslashes($nbm_user['username']).'['.get_email_address_as_display_text($nbm_user['mail_address']).']';
         if (isset($_POST['trueify']) and isset($_POST['cat_false']) and in_array($nbm_user['check_key'], $_POST['cat_false']))
         {
@@ -719,5 +719,5 @@
                               !in_array($nbm_user['check_key'], $_POST['send_selection']) // not selected
                             )   ? '' : 'checked="checked"',
-              'USERNAME'=> $nbm_user['username'],
+              'USERNAME'=> stripslashes($nbm_user['username']),
               'EMAIL' => get_email_address_as_display_text($nbm_user['mail_address']),
               'LAST_SEND'=> $nbm_user['last_send']
Index: /trunk/admin/rating.php
===================================================================
--- /trunk/admin/rating.php	(revision 4303)
+++ /trunk/admin/rating.php	(revision 4304)
@@ -97,5 +97,5 @@
 while ($row = mysql_fetch_assoc($result))
 {
-  $users[$row['id']]=$row['username'];
+  $users[$row['id']]=stripslashes($row['username']);
 }
 
Index: /trunk/admin/upload.php
===================================================================
--- /trunk/admin/upload.php	(revision 4303)
+++ /trunk/admin/upload.php	(revision 4304)
@@ -178,5 +178,5 @@
       'PREVIEW_URL_IMG'=>$preview_url,
       'UPLOAD_EMAIL'=>get_email_address_as_display_text($row['mail_address']),
-      'UPLOAD_USERNAME'=>$row['username']
+      'UPLOAD_USERNAME'=>stripslashes($row['username'])
     );
 
Index: /trunk/admin/user_list.php
===================================================================
--- /trunk/admin/user_list.php	(revision 4303)
+++ /trunk/admin/user_list.php	(revision 4304)
@@ -703,5 +703,5 @@
       'U_PROFILE' => $profile_url.$local_user['id'],
       'U_PERM' => $perm_url.$local_user['id'],
-      'USERNAME' => $local_user['username']
+      'USERNAME' => stripslashes($local_user['username'])
         .($local_user['id'] == $conf['guest_id']
           ? '<br>['.l10n('is_the_guest').']' : '')
Index: /trunk/feed.php
===================================================================
--- /trunk/feed.php	(revision 4303)
+++ /trunk/feed.php	(revision 4304)
@@ -107,5 +107,5 @@
 $rss->encoding=get_pwg_charset();
 $rss->title = $conf['gallery_title'];
-$rss->title.= ' (as '.$user['username'].')';
+$rss->title.= ' (as '.stripslashes($user['username']).')';
 
 $rss->link = $conf['gallery_url'];
Index: /trunk/include/functions_comment.inc.php
===================================================================
--- /trunk/include/functions_comment.inc.php	(revision 4303)
+++ /trunk/include/functions_comment.inc.php	(revision 4304)
@@ -100,5 +100,5 @@
 SELECT COUNT(*) AS user_exists
   FROM '.USERS_TABLE.'
-  WHERE '.$conf['user_fields']['username']." = '".$comm['author']."'";
+  WHERE '.$conf['user_fields']['username']." = '".addslashes($comm['author'])."'";
       $row = mysql_fetch_assoc( pwg_query( $query ) );
       if ( $row['user_exists'] == 1 )
Index: /trunk/include/functions_mail.inc.php
===================================================================
--- /trunk/include/functions_mail.inc.php	(revision 4303)
+++ /trunk/include/functions_mail.inc.php	(revision 4304)
@@ -365,5 +365,5 @@
     $keyargs_content_admin_info = array
     (
-      get_l10n_args('Connected user: %s', $user['username']),
+      get_l10n_args('Connected user: %s', stripslashes($user['username'])),
       get_l10n_args('IP: %s', $_SERVER['REMOTE_ADDR']),
       get_l10n_args('Browser: %s', $_SERVER['HTTP_USER_AGENT'])
@@ -484,5 +484,5 @@
           if (!empty($row['mail_address']))
           {
-            array_push($Bcc, format_email($row['username'], $row['mail_address']));
+            array_push($Bcc, format_email(stripslashes($row['username']), $row['mail_address']));
           }
         }
@@ -795,5 +795,5 @@
     if ( mkgetdir( $dir,  MKGETDIR_DEFAULT&~MKGETDIR_DIE_ON_ERROR) )
     {
-      $filename = $dir.'/mail.'.$user['username'].'.'.$lang_info['code'].'.'.$args['template'].'.'.$args['theme'];
+      $filename = $dir.'/mail.'.stripslashes($user['username']).'.'.$lang_info['code'].'.'.$args['template'].'.'.$args['theme'];
       if ($args['content_format'] == 'text/plain')
       {
Index: /trunk/include/functions_user.inc.php
===================================================================
--- /trunk/include/functions_user.inc.php	(revision 4303)
+++ /trunk/include/functions_user.inc.php	(revision 4304)
@@ -171,5 +171,5 @@
       $keyargs_content = array
       (
-        get_l10n_args('User: %s', $login),
+        get_l10n_args('User: %s', stripslashes($login)),
         get_l10n_args('Email: %s', $_POST['mail_address']),
         get_l10n_args('', ''),
@@ -179,5 +179,5 @@
       pwg_mail_notification_admins
       (
-        get_l10n_args('Registration of %s', $login),
+        get_l10n_args('Registration of %s', stripslashes($login)),
         $keyargs_content
       );
@@ -934,6 +934,6 @@
   {
     $row = mysql_fetch_assoc($result);
-    $username = $row['username'];
-    $data = $time.$row['username'].$row['password'];
+    $username = stripslashes($row['username']);
+    $data = $time.stripslashes($row['username']).$row['password'];
     $key = base64_encode(
       pack('H*', sha1($data))
@@ -1019,5 +1019,5 @@
       {
         log_user($cookie[0], true);
-        trigger_action('login_success', $username);
+        trigger_action('login_success', stripslashes($username));
         return true;
       }
@@ -1040,5 +1040,5 @@
        '.$conf['user_fields']['password'].' AS password
   FROM '.USERS_TABLE.'
-  WHERE '.$conf['user_fields']['username'].' = \''.$username.'\'
+  WHERE '.$conf['user_fields']['username'].' = \''.mysql_real_escape_string($username).'\'
 ;';
   $row = mysql_fetch_assoc(pwg_query($query));
@@ -1046,8 +1046,8 @@
   {
     log_user($row['id'], $remember_me);
-    trigger_action('login_success', $username);
+    trigger_action('login_success', stripslashes($username));
     return true;
   }
-  trigger_action('login_failure', $username);
+  trigger_action('login_failure', stripslashes($username));
   return false;
 }
Index: /trunk/include/menubar.inc.php
===================================================================
--- /trunk/include/menubar.inc.php	(revision 4303)
+++ /trunk/include/menubar.inc.php	(revision 4304)
@@ -282,5 +282,5 @@
   else
   {
-    $template->assign('USERNAME', $user['username']);
+    $template->assign('USERNAME', stripslashes($user['username']));
     if (is_autorize_status(ACCESS_CLASSIC))
     {
Index: /trunk/include/picture_comment.inc.php
===================================================================
--- /trunk/include/picture_comment.inc.php	(revision 4303)
+++ /trunk/include/picture_comment.inc.php	(revision 4304)
@@ -47,6 +47,6 @@
 
   $comm = array(
-    'author' => trim(@$_POST['author']),
-    'content' => trim($_POST['content']),
+    'author' => trim( stripslashes(@$_POST['author']) ),
+    'content' => trim( stripslashes($_POST['content']) ),
     'image_id' => $page['image_id'],
    );
@@ -153,5 +153,5 @@
       else
       {
-	$author = $row['username'];
+	$author = stripslashes($row['username']);
       }
 
Index: /trunk/include/ws_functions.inc.php
===================================================================
--- /trunk/include/ws_functions.inc.php	(revision 4303)
+++ /trunk/include/ws_functions.inc.php	(revision 4304)
@@ -524,6 +524,6 @@
 
   $comm = array(
-    'author' => trim($params['author']),
-    'content' => trim($params['content']),
+    'author' => trim( stripslashes($params['author']) ),
+    'content' => trim( stripslashes($params['content']) ),
     'image_id' => $params['image_id'],
    );
@@ -701,5 +701,5 @@
       )
   {
-    $comment_post_data['author'] = $user['username'];
+    $comment_post_data['author'] = stripslashes($user['username']);
     $comment_post_data['key'] = get_comment_post_key($params['image_id']);
   }
@@ -1255,5 +1255,5 @@
   global $user;
   $res = array();
-  $res['username'] = is_a_guest() ? 'guest' : $user['username'];
+  $res['username'] = is_a_guest() ? 'guest' : stripslashes($user['username']);
   foreach ( array('status', 'template', 'theme', 'language') as $k )
   {
Index: /trunk/password.php
===================================================================
--- /trunk/password.php	(revision 4303)
+++ /trunk/password.php	(revision 4304)
@@ -85,5 +85,5 @@
 
         $infos =
-          l10n('Username').': '.$row['username']
+          l10n('Username').': '.stripslashes($row['username'])
           ."\n".l10n('Password').': '.$new_password
           ;
Index: /trunk/profile.php
===================================================================
--- /trunk/profile.php	(revision 4303)
+++ /trunk/profile.php	(revision 4304)
@@ -244,5 +244,5 @@
   $template->assign(
     array(
-      'USERNAME'=>$userdata['username'],
+      'USERNAME'=>stripslashes($userdata['username']),
       'EMAIL'=>get_email_address_as_display_text(@$userdata['email']),
       'NB_IMAGE_LINE'=>$userdata['nb_image_line'],
Index: /trunk/upload.php
===================================================================
--- /trunk/upload.php	(revision 4303)
+++ /trunk/upload.php	(revision 4304)
@@ -361,8 +361,8 @@
   array(
     'ADVISE_TITLE' => $advise_title,
-    'NAME' => $username,
+    'NAME' => stripslashes($username),
     'EMAIL' => $mail_address,
     'NAME_IMG' => $name,
-    'AUTHOR_IMG' => $author,
+    'AUTHOR_IMG' => stripslashes($author),
     'DATE_IMG' => $date_creation,
     'COMMENT_IMG' => $comment,
