Potential SQL Injection within the Authentication (via User-Agent)

[datasiph0n]

file: classes/users.php function: authenticate($username,$password,$remember = false)

Line 108: $useragent = $_SERVER["HTTP_USER_AGENT"]; Line 116: $insert = $db->insert('users_sessions',array('user_id','ip','useragent','time','last_time','hash','remember'), array($fetch['id'],$ip,$useragent,time(),time(),$cookie_hash,$remember));

[mujs]

adding real_escape_string funtion inside $db->insert() would fix that I guess ?

[datasiph0n]

That or you could sanitize it when you declare $useragent @ line 108.