diff -urN punbb-1.2.11/upload/admin_options.php punbb-1.2.13/upload/admin_options.php
--- punbb-1.2.11/upload/admin_options.php	Wed Jul 27 22:24:24 2005
+++ punbb-1.2.13/upload/admin_options.php	Wed Sep 27 00:48:56 2006
@@ -63,6 +63,9 @@
 	if (substr($form['base_url'], -1) == '/')
 		$form['base_url'] = substr($form['base_url'], 0, -1);
 
+	// Clean avatars_dir
+	$form['avatars_dir'] = str_replace("\0", '', $form['avatars_dir']);
+
 	// Make sure avatars_dir doesn't end with a slash
 	if (substr($form['avatars_dir'], -1) == '/')
 		$form['avatars_dir'] = substr($form['avatars_dir'], 0, -1);
diff -urN punbb-1.2.11/upload/include/functions.php punbb-1.2.13/upload/include/functions.php
--- punbb-1.2.11/upload/include/functions.php	Tue Nov  1 00:10:48 2005
+++ punbb-1.2.13/upload/include/functions.php	Wed Sep 27 00:46:26 2006
@@ -138,7 +138,10 @@
 	// Enable sending of a P3P header by removing // from the following line (try this if login is failing in IE6)
 //	@header('P3P: CP="CUR ADM"');
 
-	setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure);
+	if (version_compare(PHP_VERSION, '5.2.0', '>='))
+		setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure, true);
+	else
+		setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path.'; HttpOnly', $cookie_domain, $cookie_secure);
 }
 
 
@@ -1031,22 +1034,22 @@
 //
 // Unset any variables instantiated as a result of register_globals being enabled
 //
-function unregister_globals()
+function unregister_globals()
 {
-	// Prevent script.php?GLOBALS[foo]=bar
-	if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS']))
-		exit('I\'ll have a steak sandwich and... a steak sandwich.');
-	
-	// Variables that shouldn't be unset
-	$no_unset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES');
+	// Prevent script.php?GLOBALS[foo]=bar
+	if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS']))
+		exit('I\'ll have a steak sandwich and... a steak sandwich.');
+	
+	// Variables that shouldn't be unset
+	$no_unset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES');
 
 	// Remove elements in $GLOBALS that are present in any of the superglobals
-	$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
+	$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
 	foreach ($input as $k => $v)
-	{
-		if (!in_array($k, $no_unset) && isset($GLOBALS[$k]))
-			unset($GLOBALS[$k]);
-	}
+	{
+		if (!in_array($k, $no_unset) && isset($GLOBALS[$k]))
+			unset($GLOBALS[$k]);
+	}
 }
 
 
diff -urN punbb-1.2.11/upload/include/parser.php punbb-1.2.13/upload/include/parser.php
--- punbb-1.2.11/upload/include/parser.php	Fri Sep  2 15:01:04 2005
+++ punbb-1.2.13/upload/include/parser.php	Sat May 20 17:42:32 2006
@@ -264,7 +264,7 @@
 {
 	global $pun_user;
 
-	$full_url = str_replace(array(' ', '\'', '`'), array('%20', '', ''), $url);
+	$full_url = str_replace(array(' ', '\'', '`', '"'), array('%20', '', '', ''), $url);
 	if (strpos($url, 'www.') === 0)			// If it starts with www, we add http://
 		$full_url = 'http://'.$full_url;
 	else if (strpos($url, 'ftp.') === 0)	// Else if it starts with ftp, we add ftp://
diff -urN punbb-1.2.11/upload/install.php punbb-1.2.13/upload/install.php
--- punbb-1.2.11/upload/install.php	Tue Feb 28 19:23:46 2006
+++ punbb-1.2.13/upload/install.php	Wed Sep 27 01:23:02 2006
@@ -24,7 +24,7 @@
 
 
 // The PunBB version this script installs
-$punbb_version = '1.2.11';
+$punbb_version = '1.2.13';
 
 
 define('PUN_ROOT', './');
diff -urN punbb-1.2.11/upload/login.php punbb-1.2.13/upload/login.php
--- punbb-1.2.11/upload/login.php	Wed Sep 21 23:36:08 2005
+++ punbb-1.2.13/upload/login.php	Sat May 20 17:52:02 2006
@@ -78,7 +78,7 @@
 	$expire = ($save_pass == '1') ? time() + 31536000 : 0;
 	pun_setcookie($user_id, $form_password_hash, $expire);
 
-	redirect($_POST['redirect_url'], $lang_login['Login redirect']);
+	redirect(htmlspecialchars($_POST['redirect_url']), $lang_login['Login redirect']);
 }
 
 
diff -urN punbb-1.2.11/upload/misc.php punbb-1.2.13/upload/misc.php
--- punbb-1.2.11/upload/misc.php	Sun Jul  3 12:54:30 2005
+++ punbb-1.2.13/upload/misc.php	Sat May 20 17:52:02 2006
@@ -120,7 +120,7 @@
 
 		pun_mail($recipient_email, $mail_subject, $mail_message, '"'.str_replace('"', '', $pun_user['username']).'" <'.$pun_user['email'].'>');
 
-		redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']);
+		redirect(htmlspecialchars($_POST['redirect_url']), $lang_misc['E-mail sent redirect']);
 	}
 
 
diff -urN punbb-1.2.11/upload/userlist.php punbb-1.2.13/upload/userlist.php
--- punbb-1.2.11/upload/userlist.php	Thu Mar  3 01:08:18 2005
+++ punbb-1.2.13/upload/userlist.php	Sat May 20 17:53:28 2006
@@ -116,7 +116,7 @@
 	$where_sql[] = 'u.group_id='.$show_group;
 
 // Fetch user count
-$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u'.(!empty($where_sql) ? ' WHERE u.id>1 AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
+$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u WHERE u.id>1'.(!empty($where_sql) ? ' AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
 $num_users = $db->result($result);
 
 
