https://www.icyphoenix.com/viewtopic.php?f=35&t=8737&p=57108#p57108
-----------------------------------
jefazo666
Tue 16 Oct, 2012 16:21

Re: Custom Profile Record Error.
-----------------------------------
On older versions of HTTP, you could include a ' character on a text field on Login. This then should be passed to the SQL query and you could cause a syntax problem. Because of this Ctracker blocks this character on text fields. 

The people wrotes at username something like : 

" username' or 1==1 "

This changed the sql query and the OR with the 1==1 expresion, made that someone could login as anyone he wanted. 

This is the reason why Ctracker blocks this character on text fields. The question is: if I have disabled the CTRacker, why this keeps working?

This issue with character was solved long time ago, so now Ctracker is checking for something useless.


