...
38    function format_data($r)
39    {
40       return mysql_escape_string(stripslashes(trim($r)));
41    }
...
68       $user_name = $diy->format_data($diy->post['user_name']);       
69       $user_pass = $diy->format_data(md5($diy->post['user_pass']));
70       $result = $diy->query("SELECT userid,username,password,groupid
71									FROM diy_users
72									WHERE  (username ='$user_name')
73									AND (password ='$user_pass')
74									AND (groupid = 1)");
75       if (@$diy->dbnumrows($result) > 0) {
...

...
410        else  if ($action=="uploadtemp")
411        {
412            $upload = $diy->files["name_file"];
413            $theme  = str_replace(' ','_',$diy->post[theme]);
414            $tmp_name =  $upload["tmp_name"];
415
416            if (is_uploaded_file($upload['tmp_name']))
417            {
418                $path = $diy->upload_path."/".$upload['name'];
419                if(move_uploaded_file($tmp_name, $path))
420                {
...