Custom Field: SQL Injection

1) Create new custom text area field "sqlinject", tied to asset, enabled
2) ensure magic_quotes_gpc is turned off per http://www.tracmor.com/forum/topic/119/ … es-needed/ (restart if needed)
3) add new asset, use as input for sqlinject custom field {I'd not type something like; drop table assets ; in this field} (sans curlies)
4) note error
5) rejoice

... unless I was updating said field.

tracmor 0.2.0; ubuntu intrepid/ standard apache2/php w/ php mem increased + magic_quotes_gpc off