md5 hashes are crackable especially since most people use simple dictionary words. That's not CGing but rather taking advantage of holes in the php script. Or in the case of neomallers, an user with too much admin access. ----------------------------- [color=purple]Are you protected?[/color] http://www.neopets.com/~punchback_bob CG information & more

Actually, neomallers was broken into last year around March through a moderator account. They uploaded that script you mentioned to our servers and got into admin. And yes our hash tables were taken. And yep I'm posting about it on a public forum as well lol But we've taken action against it. Moderator accounts are limited to editing forum posts only and even then, a strict filter is in place. We also have the capability to monitor changes to our file system as well as critical content areas of our database. There is also another layer of security that is being added to the site but i can't really release the details of that as it is our final line of defence :P In terms of neo fan sites, i know sunny neo was broken into.. but apart from that, not sure. And yeah, it's detectable by admins but only if they are watching their files+database With that being said, if the password on fan sites is different from neopets, it wouldn't be an issue. ----------------------------- [color=purple]Are you protected?[/color] http://www.neopets.com/~punchback_bob CG information & more