Index: templates.xmb
===================================================================
--- templates.xmb	(revision 2604)
+++ templates.xmb	(revision 2664)
@@ -1336,7 +1336,7 @@
 <td class="smalltxt" bgcolor="$altbg2">
 $versionlong
 <br />
-<a href="http://www.xmbforum.com" onclick="window.open(this.href); return false;"><strong>{$lang['xmbforum']}</strong></a>&nbsp;&copy; $copyright $lang[xmbgroup]
+<a href="http://www.xmbforum2.com/" onclick="window.open(this.href); return false;"><strong>{$lang['xmbforum']}</strong></a>&nbsp;&copy; $copyright $lang[xmbgroup]
 <br />
 $footerstuff[totaltime]
 $footerstuff[querynum]
@@ -1743,7 +1743,7 @@
 <a href="javascript:bold()" accesskey="b" title="$lang[cb_insert_bold]"><img src="$imgdir/bb_bold.gif" border="0" width="23" height="22" alt="$lang[cb_insert_bold]" /></a>
 <a href="javascript:italicize()" accesskey="i" title="$lang[cb_insert_italics]"><img src="$imgdir/bb_italicize.gif" border="0" width="23" height="22" alt="$lang[cb_insert_italics]" /></a>
 <a href="javascript:underline()" accesskey="u" title="$lang[cb_insert_underlined]"><img src="$imgdir/bb_underline.gif" border="0" width="23" height="22" alt="$lang[cb_insert_underlined]" /></a>
-<a href="javascript:center()" title="lang[cb_insert_centered]" ><img src="$imgdir/bb_center.gif" border="0" width="23" height="22" alt="$lang[cb_insert_centered]" /></a>
+<a href="javascript:center()" title="$lang[cb_insert_centered]" ><img src="$imgdir/bb_center.gif" border="0" width="23" height="22" alt="$lang[cb_insert_centered]" /></a>
 <a href="javascript:hyperlink()" title="$lang[cb_insert_hyperlink]" ><img src="$imgdir/bb_url.gif" border="0" width="23" height="22" alt="$lang[cb_insert_hyperlink]" /></a>
 <a href="javascript:email()" title="$lang[cb_insert_email]" ><img src="$imgdir/bb_email.gif" border="0" width="23" height="22" alt="$lang[cb_insert_email]" /></a>
 <a href="javascript:image()" title="$lang[cb_insert_image]" ><img src="$imgdir/bb_image.gif" border="0" width="23" height="22" alt="$lang[cb_insert_image]" /></a>
@@ -3648,7 +3648,7 @@
 
 |#*XMB TEMPLATE FILE*#|post_reply|#*XMB TEMPLATE*#|
 $preview
-<form method="post" name="input" action="post.php?action=reply&amp;fid=$fid&amp;tid=$tid" enctype="multipart/form-data">
+<form method="post" name="input" action="post.php?action=reply&amp;tid=$tid" enctype="multipart/form-data">
 <input type="hidden" name="token" value="" />
 <table cellspacing="0" cellpadding="0" border="0" width="$tablewidth" align="center">
 <tr>
@@ -4301,7 +4301,7 @@
 <tr>
 <td align="center"><font style="font-size: 10px; font-family: Verdana">$versionlong
 <br />
-$lang[developedby]&nbsp;<a href="http://www.xmbforum.com" onclick="window.open(this.href); return false;">$lang[xmbgroup]</a>&nbsp;&copy; $copyright</font></td>
+<a href="http://www.xmbforum2.com/" onclick="window.open(this.href); return false;"><strong>{$lang['xmbforum']}</strong></a>&nbsp;&copy; $copyright $lang[xmbgroup]</font></td>
 </tr>
 </table>
 </body>
@@ -4890,7 +4890,7 @@
 <a href="vtmisc.php?action=report&amp;fid=$fid&amp;tid=$tid&amp;pid=$post[pid]" title="$lang[altreportpost]"><img src="$imgdir/report.gif" border="0" alt="$lang[altreportpost]" /></a>
 
 |#*XMB TEMPLATE FILE*#|viewthread_post_repquote|#*XMB TEMPLATE*#|
-<a href="post.php?action=reply&amp;fid=$fid&amp;tid=$tid&amp;repquote=$post[pid]" title="$lang[altquote]"><img src="$imgdir/quote.gif" border="0" alt="$lang[altquote]" /></a>
+<a href="post.php?action=reply&amp;tid=$tid&amp;repquote=$post[pid]" title="$lang[altquote]"><img src="$imgdir/quote.gif" border="0" alt="$lang[altquote]" /></a>
 
 |#*XMB TEMPLATE FILE*#|viewthread_post_search|#*XMB TEMPLATE*#|
 <a href="search.php?srchuname=$encodename&amp;searchsubmit=a&amp;f=all&amp;srchfrom=0" title="$lang[altfindposts]"><img src="$imgdir/find.gif" border="0" alt="$lang[altfindposts]" /></a>
@@ -4968,7 +4968,7 @@
 |#*XMB TEMPLATE FILE*#|viewthread_quickreply|#*XMB TEMPLATE*#|
 <br />
 <a name="qreply"></a>
-<form method="post" name="input" action="post.php?action=reply&amp;fid=$fid&amp;tid=$tid">
+<form method="post" name="input" action="post.php?action=reply&amp;tid=$tid">
 <input type="hidden" name="token" value="" />
 <table width="$tablewidth" border="0" align="center" cellpadding="0" cellspacing="0" bgcolor="$bordercolor">
 <tr>
@@ -4984,7 +4984,7 @@
 $lang[textbbcodeis] $allowbbcode<br />
 $lang[textimgcodeis] $allowimgcode</span></div>
 $smilies
-<td bgcolor="$altbg2" width="56%" class="tablerow"> <div align="center"><textarea rows="10" name="message" id="message" onselect="storeCaret(this);" onclick="storeCaret(this);" onkeyup="storeCaret(this);" style="width: 100%;"></textarea></div></td>
+<td bgcolor="$altbg2" width="56%" class="tablerow"> <div align="center"><textarea rows="10" cols="80" name="message" id="message" onselect="storeCaret(this);" onclick="storeCaret(this);" onkeyup="storeCaret(this);" style="width: 100%;"></textarea></div></td>
 $quickbbcode
 <td width="20%" height="101" bgcolor="$altbg2" class="tablerow"> <div align="center">
 <table width="100%" border="0" class="tablerow" cellspacing="0" cellpadding="0">
@@ -5028,7 +5028,7 @@
 </tr>
 
 |#*XMB TEMPLATE FILE*#|viewthread_reply|#*XMB TEMPLATE*#|
-<a href="./post.php?action=reply&amp;fid=$fid&amp;tid=$tid" title="$lang[textpostreply]"><img src="$imgdir/reply.gif" border="0" alt="$lang[textpostreply]" /></a>
+<a href="./post.php?action=reply&amp;tid=$tid" title="$lang[textpostreply]"><img src="$imgdir/reply.gif" border="0" alt="$lang[textpostreply]" /></a>
 
 |#*XMB TEMPLATE FILE*#|vtmisc_report|#*XMB TEMPLATE*#|
 <form method="post" name="input" action="vtmisc.php?action=report">
Index: db/mysql.php
===================================================================
--- db/mysql.php	(revision 2604)
+++ db/mysql.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -46,15 +43,26 @@
     var $last_id    = 0;
     var $last_rows  = 0;
 
-    function connect($dbhost="localhost", $dbuser, $dbpw, $dbname, $pconnect=0, $force_db=false) {
+    /**
+     * Establishes a connection to the MySQL server.
+     *
+     * @param string $dbhost
+     * @param string $dbuser
+     * @param string $dbpw
+     * @param string $dbname
+     * @param bool   $pconnect Keep the connection open after the script ends.
+     * @param bool   $force_db Generate a fatal error if the $dbname database doesn't exist on the server.
+     * @param bool   $new_link Use to connect to a second database on the same server at the same time.
+     */
+    function connect($dbhost='localhost', $dbuser, $dbpw, $dbname, $pconnect=FALSE, $force_db=FALSE, $new_link=FALSE) {
 
         if ($pconnect) {
-            $this->link = @mysql_pconnect($dbhost, $dbuser, $dbpw);
+            $this->link = @mysql_pconnect($dbhost, $dbuser, $dbpw, $new_link);
         } else {
-            $this->link = @mysql_connect($dbhost, $dbuser, $dbpw);
+            $this->link = @mysql_connect($dbhost, $dbuser, $dbpw, $new_link);
         }
 
-        if ($this->link == false) {
+        if (FALSE === $this->link) {
             echo '<h3>Database connection error!</h3>';
             echo 'A connection to the Database could not be established.<br />';
             echo 'Please check your username, password, database name and host.<br />';
@@ -139,6 +147,21 @@
         return $return;
     }
 
+    /**
+     * Returns the length of a field as specified in the database schema.
+     *
+     * @since 1.9.11.13
+     * @param resource $query The result of a query.
+     * @param int $field The field_offset starts at 0.
+     * @return int
+     */
+    function field_len($query, $field) {
+        set_error_handler($this->errcallb);
+        $return = mysql_field_len($query, $field);
+        restore_error_handler();
+        return $return;
+    }
+
     function panic(&$sql) {
         if (!headers_sent()) {
             header('HTTP/1.0 500 Internal Server Error');
@@ -165,8 +188,12 @@
     	}
         if (LOG_MYSQL_ERRORS) {
             $log = "MySQL encountered the following error:\n$error\n(errno = $errno)\n";
-            if ($sql != '') {
-                $log .= "In the following query:\n$sql";
+            if (strlen($sql) > 0) {
+                if (1153 == $errno and strlen($sql) > 16000) {
+                    $log .= "In the following query (log truncated):\n" . substr($sql, 0, 16000);
+                } else {
+                    $log .= "In the following query:\n$sql";
+                }
             }
             if (!ini_get('log_errors')) {
                 ini_set('log_errors', TRUE);
@@ -260,7 +287,11 @@
                         ini_set('log_errors', TRUE);
                         ini_set('error_log', 'error_log');
                     }
-                    $output = "MySQL generated $warnings warnings in the following query:\n$sql\n";
+                    if (strlen($sql) > 16000) {
+                        $output = "MySQL generated $warnings warnings in the following query (log truncated):\n" . substr($sql, 0, 16000) . "\n";
+                    } else {
+                        $output = "MySQL generated $warnings warnings in the following query:\n$sql\n";
+                    }
                     $query3 = mysql_query('SHOW WARNINGS', $this->link);
                     while ($row = mysql_fetch_array($query3, SQL_ASSOC)) {
                         $output .= var_export($row, TRUE)."\n";
Index: member.php
===================================================================
--- member.php	(revision 2604)
+++ member.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -320,6 +317,7 @@
 
             $nonprinting = '\\x00-\\x1F\\x7F';  //Universal chars that are invalid.
             $specials = '\\]\'<>\\\\|"[,@';  //Other universal chars disallowed by XMB: []'"<>\|,@
+            $sequences = '|  ';  //Phrases disallowed, each separated by '|'
             $icharset = strtoupper($charset);
             if (substr($icharset, 0, 8) == 'ISO-8859') {
                 if ($icharset == 'ISO-8859-11') {
@@ -331,7 +329,7 @@
                 $nonprinting .= '\\xAD';  //More chars invalid for all Windows code pages.
             }
 
-            if ($_POST['username'] != preg_replace("#[{$nonprinting}{$specials}]#", '', $_POST['username'])) {
+            if ($_POST['username'] != preg_replace("#[{$nonprinting}{$specials}]{$sequences}#", '', $_POST['username'])) {
                 error($lang['restricted']);
             }
 
Index: post.php
===================================================================
--- post.php	(revision 2604)
+++ post.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -317,6 +314,8 @@
 }
 
 $messageinput = postedVar('message', '', TRUE, FALSE);  //postify() is responsible for DECODING if html is allowed.
+$subjectinput = postedVar('subject', 'javascript', TRUE, FALSE, TRUE);
+$subjectinput = str_replace(array("\r", "\n"), array('', ''), $subjectinput);
 
 if ($SETTINGS['spellcheck'] == 'on') {
     $spelling_submit1 = '<input type="hidden" name="subaction" value="spellcheck" /><input type="submit" class="submit" name="spellchecksubmit" value="'.$lang['checkspelling'].'" />';
@@ -493,7 +492,7 @@
         }
 
         if ($replyvalid) {
-            if (strlen(postedVar('subject')) == 0 && strlen($messageinput) == 0) {
+            if (strlen($subjectinput) == 0 && strlen($messageinput) == 0) {
                 $errors .= softerror($lang['postnothing']);
                 $replyvalid = FALSE;
             }
@@ -529,9 +528,27 @@
             if ($bBBcodeOnForThisPost) {
                 postLinkBBcode($messageinput);
             }
+
             $dbmessage = addslashes($messageinput); //The message column is historically double-quoted.
+            $dbsubject = addslashes($subjectinput);
+
+            if (strlen($dbmessage) > 65535 or strlen($dbsubject) > 255) {
+                // Inputs are suspiciously long.  Has the schema been customized?
+                $query = $db->query("SELECT message, subject FROM ".X_PREFIX."posts WHERE 1=0");
+                $msgmax = $db->field_len($query, 0);
+                $submax = $db->field_len($query, 1);
+                $db->free_result($query);
+                if (strlen($dbmessage) > $msgmax) {
+                    $dbmessage = substr($dbmessage, 0, $msgmax);
+                }
+                if (strlen($dbsubject) > $submax) {
+                    $dbsubject = substr($dbsubject, 0, $submax);
+                }
+            }
+
             $db->escape_fast($dbmessage);
-            $dbsubject = addslashes(postedVar('subject', 'javascript', TRUE, TRUE, TRUE));
+            $db->escape_fast($dbsubject);
+
             $db->query("INSERT INTO ".X_PREFIX."posts (fid, tid, author, message, subject, dateline, icon, usesig, useip, bbcodeoff, smileyoff) VALUES ($fid, $tid, '$username', '$dbmessage', '$dbsubject', ".$db->time(time()).", '$posticon', '$usesig', '$onlineip', '$bbcodeoff', '$smileyoff')");
             $pid = $db->insert_id();
 
@@ -567,7 +584,16 @@
 
             $lang2 = loadPhrases(array('charset','textsubsubject','textsubbody'));
             $viewperm = getOneForumPerm($forum, X_PERMS_RAWVIEW);
-            $date = $db->result($db->query("SELECT dateline FROM ".X_PREFIX."posts WHERE tid='$tid' AND pid < $pid ORDER BY dateline DESC LIMIT 1"), 0);
+
+            $query = $db->query("SELECT dateline FROM ".X_PREFIX."posts WHERE tid = $tid AND pid < $pid ORDER BY dateline DESC LIMIT 1");
+            if ($db->num_rows($query) > 0) {
+                $date = $db->result($query, 0);
+            } else {
+                // Replying to a thread that has zero posts.
+                $date = '0';
+            }
+            $db->free_result($query);
+
             $subquery = $db->query("SELECT m.email, m.lastvisit, m.ppp, m.status, m.langfile "
                                  . "FROM ".X_PREFIX."favorites f "
                                  . "INNER JOIN ".X_PREFIX."members m USING (username) "
@@ -633,8 +659,14 @@
                 $quoteperms = checkForumPermissions(getForum($thaquote['fid']));
                 if ($quoteperms[X_PERMS_VIEW] And $quoteperms[X_PERMS_PASSWORD]) {
                     $thaquote['message'] = preg_replace('@\\[file\\]\\d*\\[/file\\]@', '', $thaquote['message']); //These codes will not work inside quotes.
-                    //Note this bbcode is a pseudo-link. Treat it as cdata.  Do not recode the author string.
-                    $messageinput = "[rquote=$repquote&amp;tid={$thaquote['tid']}&amp;author={$thaquote['author']}]".rawHTMLmessage(stripslashes($thaquote['message']))."[/rquote]"; //Messages are historically double-quoted.
+                    $quoteblock = rawHTMLmessage(stripslashes($thaquote['message'])); //Messages are historically double-quoted.
+                    if ($bBBcodeOnForThisPost) {
+                        $messageinput = "[rquote=$repquote&amp;tid={$thaquote['tid']}&amp;author={$thaquote['author']}]{$quoteblock}[/rquote]";
+                    } else {
+                        $quotesep = '|| ';
+                        $quoteblock = $quotesep.str_replace("\n", "\n$quotesep", $quoteblock);
+                        $messageinput = "{$lang['textquote']} {$lang['origpostedby']} {$thaquote['author']}\r\n$quotesep\r\n$quoteblock\r\n\r\n";
+                    }
                 }
             }
 
@@ -677,7 +709,7 @@
             }
 
             //Allow sanitized message to pass-through to template in case of: #1 preview, #2 post error
-            $subject = rawHTMLsubject(postedVar('subject', 'javascript', TRUE, FALSE, TRUE));
+            $subject = rawHTMLsubject($subjectinput);
             $message = rawHTMLmessage($messageinput);
 
             if (isset($previewpost)) {
@@ -872,7 +904,7 @@
         }
 
         if ($topicvalid) {
-            if (strlen(postedVar('subject')) == 0) {
+            if (strlen($subjectinput) == 0) {
                 $errors .= softerror($lang['textnosubject']);
                 $topicvalid = FALSE;
             }
@@ -927,9 +959,35 @@
                 postLinkBBcode($messageinput);
             }
             $dbmessage = addslashes($messageinput); //The message column is historically double-quoted.
+            $dbsubject = addslashes($subjectinput);
+            $dbtsubject = $dbsubject;
+
+            if (strlen($dbmessage) > 65535 or strlen($dbsubject) > 128) {
+                // Inputs are suspiciously long.  Has the schema been customized?
+                $query = $db->query("SELECT message, subject FROM ".X_PREFIX."posts WHERE 1=0");
+                $msgmax = $db->field_len($query, 0);
+                $submax = $db->field_len($query, 1);
+                $db->free_result($query);
+                if (strlen($dbmessage) > $msgmax) {
+                    $dbmessage = substr($dbmessage, 0, $msgmax);
+                }
+                if (strlen($dbsubject) > $submax) {
+                    $dbsubject = substr($dbsubject, 0, $submax);
+                }
+
+                $query = $db->query("SELECT subject FROM ".X_PREFIX."threads WHERE 1=0");
+                $tsubmax = $db->field_len($query, 0);
+                $db->free_result($query);
+                if (strlen($dbtsubject) > $tsubmax) {
+                    $dbtsubject = substr($dbtsubject, 0, $tsubmax);
+                }
+            }
+
             $db->escape_fast($dbmessage);
-            $dbsubject = addslashes(postedVar('subject', 'javascript', TRUE, TRUE, TRUE));
-            $db->query("INSERT INTO ".X_PREFIX."threads (fid, subject, icon, lastpost, views, replies, author, closed, topped) VALUES ($fid, '$dbsubject', '$posticon', '$thatime|$username', 0, 0, '$username', '', 0)");
+            $db->escape_fast($dbsubject);
+            $db->escape_fast($dbtsubject);
+
+            $db->query("INSERT INTO ".X_PREFIX."threads (fid, subject, icon, lastpost, views, replies, author, closed, topped) VALUES ($fid, '$dbtsubject', '$posticon', '$thatime|$username', 0, 0, '$username', '', 0)");
             $tid = $db->insert_id();
 
             $db->query("INSERT INTO ".X_PREFIX."posts (fid, tid, author, message, subject, dateline, icon, usesig, useip, bbcodeoff, smileyoff) VALUES ($fid, $tid, '$username', '$dbmessage', '$dbsubject', ".$db->time($thatime).", '$posticon', '$usesig', '$onlineip', '$bbcodeoff', '$smileyoff')");
@@ -957,7 +1015,8 @@
                 }
                 $db->free_result($query);
 
-                $dbsubject = addslashes(postedVar('subject', 'javascript', TRUE, TRUE, TRUE));
+                $dbsubject = addslashes($subjectinput);
+                $db->escape_fast($dbsubject);
                 $db->query("INSERT INTO ".X_PREFIX."vote_desc (topic_id, vote_text) VALUES ($tid, '$dbsubject')");
                 $vote_id =  $db->insert_id();
                 $i = 1;
@@ -1061,7 +1120,7 @@
             }
 
             //Allow sanitized message to pass-through to template in case of: #1 preview, #2 post error
-            $subject = rawHTMLsubject(postedVar('subject', 'javascript', TRUE, FALSE, TRUE));
+            $subject = rawHTMLsubject($subjectinput);
             $message = rawHTMLmessage($messageinput);
 
             if (isset($previewpost)) {
@@ -1204,7 +1263,7 @@
             $isfirstpost = $db->fetch_array($query);
             $db->free_result($query);
 
-            if ((strlen(postedVar('subject')) == 0 && $pid == $isfirstpost['pid']) && !(isset($delete) && $delete == 'yes')) {
+            if ((strlen($subjectinput) == 0 && $pid == $isfirstpost['pid']) && !(isset($delete) && $delete == 'yes')) {
                 $errors .= softerror($lang['textnosubject']);
                 $editvalid = FALSE;
             }
@@ -1222,8 +1281,24 @@
                     postLinkBBcode($messageinput);
                 }
                 $dbmessage = addslashes($messageinput); //The message column is historically double-quoted.
+                $dbsubject = addslashes($subjectinput);
+
+                if (strlen($dbmessage) > 65535 or strlen($dbsubject) > 255) {
+                    // Inputs are suspiciously long.  Has the schema been customized?
+                    $query = $db->query("SELECT message, subject FROM ".X_PREFIX."posts WHERE 1=0");
+                    $msgmax = $db->field_len($query, 0);
+                    $submax = $db->field_len($query, 1);
+                    $db->free_result($query);
+                    if (strlen($dbmessage) > $msgmax) {
+                        $dbmessage = substr($dbmessage, 0, $msgmax);
+                    }
+                    if (strlen($dbsubject) > $submax) {
+                        $dbsubject = substr($dbsubject, 0, $submax);
+                    }
+                }
+
                 $db->escape_fast($dbmessage);
-                $dbsubject = addslashes(postedVar('subject', 'javascript', TRUE, TRUE, TRUE));
+                $db->escape_fast($dbsubject);
 
                 if ($isfirstpost['pid'] == $pid) {
                     $db->query("UPDATE ".X_PREFIX."threads SET icon='$posticon', subject='$dbsubject' WHERE tid=$tid");
@@ -1280,7 +1355,6 @@
 
         if (!$editvalid) {
             // Fill $postinfo
-            $subjectinput = postedVar('subject', 'javascript', TRUE, FALSE, TRUE);
             if (onSubmit('editsubmit') || isset($previewpost) || $sc) {
                 $postinfo = array("usesig"=>$usesig, "bbcodeoff"=>$bbcodeoff, "smileyoff"=>$smileyoff, "message"=>$messageinput, "subject"=>$subjectinput, 'icon'=>$posticon, 'dateline'=>$orig['dateline']);
             } else {
Index: header.php
===================================================================
--- header.php	(revision 2604)
+++ header.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -43,12 +40,12 @@
 $versioncompany = 'The XMB Group';
 $versionshort = '1.9.11';
 $versiongeneral = 'XMB 1.9.11';
-$copyright = '2001-2011';
+$copyright = '2001-2012';
 $alpha = '';
 $beta = '';
 $gamma = '';
 $service_pack = '';
-$versionbuild = 20110205;
+$versionbuild = 20120202;
 $mtime = explode(" ", microtime());
 $starttime = $mtime[1] + $mtime[0];
 $onlinetime = time();
@@ -400,6 +397,8 @@
     header("Content-type: text/html");
 }
 
+ini_set('user_agent', "XMB-eXtreme-Message-Board/1.9; $full_url");
+
 // Update last visit cookies
 $xmblva = getInt('xmblva', 'c'); // Last visit
 $xmblvb = getInt('xmblvb', 'c'); // Duration of this visit (considered to be up to 600 seconds)
Index: include/admin.inc.php
===================================================================
--- include/admin.inc.php	(revision 2604)
+++ include/admin.inc.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -158,7 +155,7 @@
 
         $nameokay = true;
 
-        if ($userto != preg_replace('#[\]\'\x00-\x1F\x7F<>\\\\|"[,@]#', '', $userto)) {
+        if ($userto != preg_replace('#[\]\'\x00-\x1F\x7F<>\\\\|"[,@]|  #', '', $userto)) {
             return false;
         }
 
@@ -294,7 +291,7 @@
     }
 }
 
-function printsetting1(&$setname, $varname, &$check1, &$check2) {
+function printsetting1($setname, $varname, $check1, $check2) {
     global $lang, $THEME;
 
     ?>
@@ -310,7 +307,7 @@
     <?php
 }
 
-function printsetting2(&$setname, $varname, $value, $size) {
+function printsetting2($setname, $varname, $value, $size) {
     global $THEME;
 
     ?>
@@ -321,7 +318,7 @@
     <?php
 }
 
-function printsetting3(&$setname, $boxname, $varnames, $values, $checked, $multi=true) {
+function printsetting3($setname, $boxname, $varnames, $values, $checked, $multi=true) {
     global $THEME, $selHTML;
 
     foreach($varnames as $key=>$val) {
@@ -340,7 +337,7 @@
     <?php
 }
 
-function printsetting4(&$settingDesc, $name, $value, $rows=5, $cols=50) {
+function printsetting4($settingDesc, $name, $value, $rows=5, $cols=50) {
     global $THEME;
 
     ?>
@@ -354,7 +351,7 @@
     <?php
 }
 
-function printsetting5(&$settingDesc, &$errorMsg) {
+function printsetting5($settingDesc, $errorMsg) {
     global $THEME;
 
     ?>
@@ -365,7 +362,7 @@
     <?php
 }
 
-function readFileAsINI(&$filename) {
+function readFileAsINI($filename) {
     $lines = file($filename);
     foreach($lines as $line_num => $line) {
         $temp = explode("=",$line);
Index: include/attach.inc.php
===================================================================
--- include/attach.inc.php	(revision 2604)
+++ include/attach.inc.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -1053,6 +1050,14 @@
         return TRUE;
     }
 
+    // Remove the code block contents from $message.
+    $messagearray = bbcodeCode($message);
+    $message = array();
+    for($i = 0; $i < count($messagearray); $i += 2) {
+        $message[$i] = $messagearray[$i];
+    }
+    $message = implode("<!-- code -->", $message);
+
     // Extract img codes
     $results = array();
     $items = array();
@@ -1080,6 +1085,16 @@
         $temppos = strpos($message, $result['code']);
         $message = substr($message, 0, $temppos).$replace.substr($message, $temppos + strlen($result['code']));
     }
+
+    // Replace the code block contents in $message.
+    if (count($messagearray) > 1) {
+        $message = explode("<!-- code -->", $message);
+        for($i = 0; $i < count($message) - 1; $i++) {
+            $message[$i] .= $messagearray[$i*2+1];
+        }
+        $message = implode("", $message);
+    }
+
     return $return;
 }
-?>
\ No newline at end of file
+?>
Index: include/functions.inc.php
===================================================================
--- include/functions.inc.php	(revision 2604)
+++ include/functions.inc.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -1169,10 +1166,14 @@
 
         // Link to first page
         $multipage .= "\n";
-        if ($page != 1 Or !$isself) {
+        if ($page != 1 or !$isself) {
             $extra = '';
             if ($isself) {
-                $extra = ' rel="start"';
+                if (2 == $page) {
+                    $extra = ' rel="prev start"';
+                } else {
+                    $extra = ' rel="start"';
+                }
             }
             $multipage .= '&nbsp;<u><a href="'.$mpurl.'"'.$extra.'>1</a></u>';
             if ($from > 2) {
@@ -1210,8 +1211,13 @@
                 $multipage .= "&nbsp;..\n";
             }
             $extra = '';
-            if ($isself And $page == 1) {
-                $extra = ' rev="start"';
+            if ($isself) {
+                if ($page == $lastpage - 1) {
+                    $extra = ' rel="next"';
+                }
+                if ($page == 1) {
+                    $extra .= ' rev="start"';
+                }
             }
             $multipage .= '&nbsp;<u><a href="'.$mpurl.$string.'page='.$lastpage.'"'.$extra.'>'.$lastpage.'</a></u>';
         } else {
Index: cp.php
===================================================================
--- cp.php	(revision 2604)
+++ cp.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -594,24 +591,31 @@
         <td colspan="2"><strong><font color="<?php echo $cattext?>"><a name="7" />&raquo;&nbsp;<?php echo $lang['admin_main_settings7']?></font></strong></td>
         </tr>
         <?php
-        printsetting1($lang['captchastatus'], 'captchanew', $captchaOn, $captchaOff);
-        printsetting1($lang['captcharegstatus'], 'captcharegnew', $captcharegOn, $captcharegOff);
-        printsetting1($lang['captchapoststatus'], 'captchapostnew', $captchapostOn, $captchapostOff);
-        printsetting1($lang['captchasearchstatus'], 'captchasearchnew', $captchasearchOn, $captchasearchOff);
-        printsetting2($lang['captchacharset'], 'captchacharsetnew', $SETTINGS['captcha_code_charset'], 50);
-        printsetting2($lang['captchacodelength'], 'captchacodenew', ((int)$SETTINGS['captcha_code_length']), 3);
-        printsetting1($lang['captchacodecase'], 'captchacodecasenew', $captchacodecaseOn, $captchacodecaseOff);
-        printsetting1($lang['captchacodeshadow'], 'captchacodeshadownew', $captchacodeshadowOn, $captchacodeshadowOff);
-        printsetting2($lang['captchaimagetype'], 'captchaimagetypenew', $SETTINGS['captcha_image_type'], 5);
-        printsetting2($lang['captchaimagewidth'], 'captchaimagewidthnew', ((int)$SETTINGS['captcha_image_width']), 5);
-        printsetting2($lang['captchaimageheight'], 'captchaimageheightnew', ((int)$SETTINGS['captcha_image_height']), 5);
-        printsetting2($lang['captchaimagebg'], 'captchaimagebgnew', $SETTINGS['captcha_image_bg'], 50);
-        printsetting2($lang['captchaimagedots'], 'captchaimagedotsnew', ((int)$SETTINGS['captcha_image_dots']), 3);
-        printsetting2($lang['captchaimagelines'], 'captchaimagelinesnew', ((int)$SETTINGS['captcha_image_lines']), 3);
-        printsetting2($lang['captchaimagefonts'], 'captchaimagefontsnew', $SETTINGS['captcha_image_fonts'], 50);
-        printsetting2($lang['captchaimageminfont'], 'captchaimageminfontnew', ((int)$SETTINGS['captcha_image_minfont']), 3);
-        printsetting2($lang['captchaimagemaxfont'], 'captchaimagemaxfontnew', ((int)$SETTINGS['captcha_image_maxfont']), 3);
-        printsetting1($lang['captchaimagecolor'], 'captchaimagecolornew', $captchaimagecolorOn, $captchaimagecolorOff);
+        require ROOT.'include/captcha.inc.php';
+        $Captcha = new Captcha();
+        if ($Captcha->bCompatible === FALSE) {
+            printsetting5($lang['captchastatus'], 'CAPTCHA is not working. Usually, this means the GD or FreeType software is missing from your PHP server.');
+        } else {
+            printsetting1($lang['captchastatus'], 'captchanew', $captchaOn, $captchaOff);
+            printsetting1($lang['captcharegstatus'], 'captcharegnew', $captcharegOn, $captcharegOff);
+            printsetting1($lang['captchapoststatus'], 'captchapostnew', $captchapostOn, $captchapostOff);
+            printsetting1($lang['captchasearchstatus'], 'captchasearchnew', $captchasearchOn, $captchasearchOff);
+            printsetting2($lang['captchacharset'], 'captchacharsetnew', $SETTINGS['captcha_code_charset'], 50);
+            printsetting2($lang['captchacodelength'], 'captchacodenew', ((int)$SETTINGS['captcha_code_length']), 3);
+            printsetting1($lang['captchacodecase'], 'captchacodecasenew', $captchacodecaseOn, $captchacodecaseOff);
+            printsetting1($lang['captchacodeshadow'], 'captchacodeshadownew', $captchacodeshadowOn, $captchacodeshadowOff);
+            printsetting2($lang['captchaimagetype'], 'captchaimagetypenew', $SETTINGS['captcha_image_type'], 5);
+            printsetting2($lang['captchaimagewidth'], 'captchaimagewidthnew', ((int)$SETTINGS['captcha_image_width']), 5);
+            printsetting2($lang['captchaimageheight'], 'captchaimageheightnew', ((int)$SETTINGS['captcha_image_height']), 5);
+            printsetting2($lang['captchaimagebg'], 'captchaimagebgnew', $SETTINGS['captcha_image_bg'], 50);
+            printsetting2($lang['captchaimagedots'], 'captchaimagedotsnew', ((int)$SETTINGS['captcha_image_dots']), 3);
+            printsetting2($lang['captchaimagelines'], 'captchaimagelinesnew', ((int)$SETTINGS['captcha_image_lines']), 3);
+            printsetting2($lang['captchaimagefonts'], 'captchaimagefontsnew', $SETTINGS['captcha_image_fonts'], 50);
+            printsetting2($lang['captchaimageminfont'], 'captchaimageminfontnew', ((int)$SETTINGS['captcha_image_minfont']), 3);
+            printsetting2($lang['captchaimagemaxfont'], 'captchaimagemaxfontnew', ((int)$SETTINGS['captcha_image_maxfont']), 3);
+            printsetting1($lang['captchaimagecolor'], 'captchaimagecolornew', $captchaimagecolorOn, $captchaimagecolorOff);
+        }
+        unset($Captcha);
         ?>
         <tr class="ctrtablerow">
         <td bgcolor="<?php echo $altbg2?>" colspan="2"><input class="submit" type="submit" name="settingsubmit7" value="<?php echo $lang['textsubmitchanges']?>" /></td>
@@ -2030,7 +2034,7 @@
         // This will also delete thread redirectors where the redirect's author is $member
         $tids = array();
         $movedids = array();
-        $countquery = $db->query("SELECT t.tid FROM ".X_PREFIX."threads AS t LEFT JOIN ".X_PREFIX."posts AS p USING (tid) WHERE t.author='$member' GROUP BY t.tid HAVING COUNT(p.pid) = 0");
+        $countquery = $db->query("SELECT t.tid FROM ".X_PREFIX."threads AS t LEFT JOIN ".X_PREFIX."posts AS p USING (tid) WHERE t.closed NOT LIKE 'moved%' GROUP BY t.tid HAVING COUNT(p.pid) = 0");
         while($threads = $db->fetch_array($countquery)) {
             $tids[] = $threads['tid'];
             $movedids[] = 'moved|'.$threads['tid'];
@@ -2088,6 +2092,7 @@
             $add = get_attached_file('sql_file', $filename, $filetype, $filesize, FALSE);
             if ($add !== FALSE) {
                 $upgrade .= $add;
+                unlink($_FILES['sql_file']['tmp_name']);
             }
         }
 
Index: viewthread.php
===================================================================
--- viewthread.php	(revision 2604)
+++ viewthread.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -722,7 +719,7 @@
 
             if ($post['subject'] != '') {
                 $linktitle = rawHTMLsubject(stripslashes($post['subject']));
-                $post['subject'] = $linktitle.'<br />';
+                $post['subject'] = wordwrap($linktitle, 150, '<br />', TRUE).'<br />';
             } else {
                 $linktitle = $thread['subject'];
             }
Index: cp2.php
===================================================================
--- cp2.php	(revision 2604)
+++ cp2.php	(revision 2664)
@@ -4,12 +4,9 @@
  * XMB 1.9.11
  *
  * Developed And Maintained By The XMB Group
- * Copyright (c) 2001-2011, The XMB Group
- * http://www.xmbforum.com
+ * Copyright (c) 2001-2012, The XMB Group
+ * http://www.xmbforum2.com/
  *
- * Sponsored By iEntry, Inc.
- * http://www.ientry.com
- *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
@@ -378,6 +375,7 @@
             }
             error($message, FALSE);
         }
+        unlink($_FILES['themefile']['tmp_name']);
 
         // Install uploaded file
         require('include/translation.inc.php');
@@ -1769,16 +1767,21 @@
         if (count($queryWhere) > 0) {
             require('include/attach-admin.inc.php');
             $tids = array();
+            $fids = array();
             $queryWhere = implode(' AND ', $queryWhere);
-            $q = $db->query("SELECT tid FROM ".X_PREFIX."threads WHERE ".$queryWhere);
+            $q = $db->query("SELECT tid, fid FROM ".X_PREFIX."threads WHERE ".$queryWhere);
             if ($db->num_rows($q) > 0) {
                 while($t = $db->fetch_array($q)) {
                     $tids[] = $t['tid'];
+                    $fids[] = $t['fid'];
                 }
                 $tids = implode(',', $tids);
+                set_time_limit(30); // Potentially expensive operations coming up.
                 deleteMultiThreadAttachments($tids); // Must delete attachments before posts!
+                set_time_limit(30);
                 $db->query("DELETE FROM ".X_PREFIX."posts WHERE tid IN ($tids)");
                 $db->query("DELETE FROM ".X_PREFIX."favorites WHERE tid IN ($tids)");
+                set_time_limit(30);
 
                 $db->query("DELETE FROM d, r, v "
                          . "USING ".X_PREFIX."vote_desc AS d "
@@ -1787,6 +1790,20 @@
                          . "WHERE d.topic_id IN ($tids)");
 
                 $db->query("DELETE FROM ".X_PREFIX."threads WHERE tid IN ($tids)");
+
+                // Update Forum Stats
+                $fids = array_unique($fids);
+                $fups = array();
+                foreach ($fids as $fid) {
+                    $forum = getForum($fid);
+                    if ('sub' == $forum['type']) {
+                        $fups[] = $forum['fup'];
+                    }
+                }
+                $fids = array_unique(array_merge($fids, $fups));
+                foreach ($fids as $fid) {
+                    updateforumcount($fid);
+                }
             }
         } else {
             $db->query("TRUNCATE TABLE ".X_PREFIX."attachments");
@@ -2629,4 +2646,4 @@
 echo '</table></td></tr></table>';
 end_time();
 eval('echo "'.template('footer').'";');
-?>
\ No newline at end of file
+?>
