When a databas error occurs, vBulletin does display the exact SQL statement used - either fully visible if the user is and administrator or as an HTML comment for normal users.
While this is very useful for debugging, it is also dangerous as attackers could get valuable information they would not be able to get otherwise.
I therefore suggest to not display statements in database error messages at all, just like display_error should be off for production systems.
At least rename database_error_page.html to database_error_page.html.new and request it being renamed in the installation instructions to avoid it being overwritten during upgraded.
__DEFINE_LIKE_SHARE__
|