ZX AntiSpam [Support Thread]

[zamzom]

Has anyone actually been using this addon? There are some really strategical errors! Check this out:

In /includes/modules/pages/account_confirmation/header_php.php around line 97

        $sql = "UPDATE " . TABLE_CUSTOMERS . "
              SET customers_default_address_id = '" . (int)$address_id . "'
              WHERE customers_id = '" . (int)$_SESSION['customer_id'] . "'";

        $db->Execute($sql);

        $sql = "INSERT INTO " . TABLE_CUSTOMERS_INFO . "
                          (customers_info_id, customers_info_number_of_logons,
                           customers_info_date_account_created, customers_info_date_of_last_logon)
              VALUES ('" . (int)$_SESSION['customer_id'] . "', '1', now(), now())";

        $db->Execute($sql); 

$sql variable used for db input string. However the same variable is used elsewhere for db output array(assigned around line 40 in the code), and around line 118 it is tried to be read again, of course after it is being corrupted:

        $_SESSION['customer_first_name'] = $sql->fields['customers_firstname'];
        $_SESSION['customer_last_name'] = $sql->fields['customers_lastname'];
        $_SESSION['customer_default_address_id'] = $address_id;
        $_SESSION['customer_country_id'] = $sql->fields['entry_country_id'];
        $_SESSION['customer_zone_id'] = $sql->fields['entry_zone_id'];
        $_SESSION['customers_authorization'] = $sql->fields['customers_authorization']; 

Should have used some other string variable for the former, for example $sql_str