Ah right thanks, I will check what the patch is, if it only effects people that have register_globals on then that's a lot different than a hole in the script
Off topic but...has anyone tried to customise HCL?
I am using it but only for live chat, I have perl desk for my ticket system, if it is easy to skin, I might consider using HCL for everything instead of seperating them.