There is a lesson to be learned here, I believe: Thoroughly vet any platform (i.e. audit as much code as you can) before you deploy it, even if you want to bel

There is a lesson to be learned here, I believe: Thoroughly vet any platform (i.e. audit as much code as you can) before you deploy it, even if you want to believe that there are a lot of well-meaning white-hats looking at the product. (Linus's Law, etc.) The SQL Injection vulnerability here was a little bit more clever than the ones you'd normally see. ($query = "SELECT * FROM table WHERE id = $tainted"; mysql_query($query);) All the more reason to take a closer look at the code. And if no one else will, I'm certainly up to the task. But I make no promises I will publish my findings.