diff -ruN 3.23/nucleus/libs/ADMIN.php 3.24/nucleus/libs/ADMIN.php
--- 3.23/nucleus/libs/ADMIN.php	2005-08-19 18:48:14.000000000 -0500
+++ 3.24/nucleus/libs/ADMIN.php	2006-11-29 15:23:33.000000000 -0600
@@ -14,7 +14,7 @@
   *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2005 The Nucleus Group
- * @version $Id: ADMIN.php,v 1.128.2.3 2005/08/19 16:48:14 dekarma Exp $
+ * @version $Id: ADMIN.php 1104 2006-11-11 10:21:45Z dekarma $
   */
 
 class ADMIN {
@@ -1757,12 +1757,12 @@
 		// check if allowed
 		($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
 
-		$name			= trim(postVar('name'));
-		$realname		= trim(postVar('realname'));
+		$name			= trim(strip_tags(postVar('name')));
+		$realname		= trim(strip_tags(postVar('realname')));
 		$password		= postVar('password');
 		$repeatpassword	= postVar('repeatpassword');
-		$email			= postVar('email');
-		$url			= postVar('url');
+		$email			= strip_tags(postVar('email'));
+		$url			= strip_tags(postVar('url'));
 
 		// Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
 		if (!eregi("^https?://", $url))
@@ -1770,7 +1770,7 @@
 
 		$admin			= postVar('admin');
 		$canlogin		= postVar('canlogin');
-		$notes			= postVar('notes');
+		$notes			= strip_tags(postVar('notes'));
 		$deflang		= postVar('deflang');
 
 		$mem = MEMBER::createFromID($memberid);
@@ -1817,9 +1817,6 @@
 				$mem->setPassword($password);
 		}
 
-		if ($newpass)
-			$mem->setPassword($password);
-
 		$oldEmail = $mem->getEmail();
 
 		$mem->setRealName($realname);
@@ -1859,7 +1856,7 @@
 
 
 		if (  ( $mem->getID() == $member->getID() )
-		   && ( $newpass || ( $mem->getDisplayName() != $member->getDisplayName() ) )
+		   && ( $mem->getDisplayName() != $member->getDisplayName() )
 		   ) {
 			$mem->newCookieKey();
 			$member->logout();
@@ -4620,7 +4617,7 @@
 			<?php		}
 		?>
 			<div class="foot">
-				<a href="http://nucleuscms.org/">Nucleus CMS</a> &copy; 2002-2005 The Nucleus Group
+				<a href="http://nucleuscms.org/">Nucleus CMS</a> &copy; 2002-<?php echo date('Y'); ?> The Nucleus Group
 				-
 				<a href="http://nucleuscms.org/donate.php">Donate!</a>
 			</div>
@@ -6076,7 +6073,7 @@
 			echo '</label>';
 			echo '</td>';
 			echo '<td>', htmlspecialchars($current->mrealname), '</td>';
-			echo "<td><a href='$current->murl' tabindex='".$template['tabindex']."'>$current->murl</a></td>";
+			echo "<td><a href='", htmlspecialchars($current->murl), "' tabindex='", $template['tabindex'] , "'>", htmlspecialchars($current->murl), "</a></td>";
 			echo '<td>', ($current->madmin ? _YES : _NO),'</td>';
 			echo '<td>', ($current->mcanlogin ? _YES : _NO), '</td>';
 			echo "<td><a href='index.php?action=memberedit&amp;memberid=$current->mnumber' tabindex='".$template['tabindex']."'>"._LISTS_EDIT."</a></td>";
diff -ruN 3.23/nucleus/libs/SKIN.php 3.24/nucleus/libs/SKIN.php
--- 3.23/nucleus/libs/SKIN.php	2005-08-15 12:50:12.000000000 -0500
+++ 3.24/nucleus/libs/SKIN.php	2006-11-29 15:23:33.000000000 -0600
@@ -16,7 +16,7 @@
   *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2005 The Nucleus Group
- * @version $Id: SKIN.php,v 1.62.2.1 2005/08/15 10:50:12 dekarma Exp $
+ * @version $Id: SKIN.php 1104 2006-11-11 10:21:45Z dekarma $
   */
 class SKIN {
 
@@ -1095,19 +1095,19 @@
 		global $blog;
 		switch($which) {
 			case 'id':
-				echo $blog->getID();
+				echo htmlspecialchars($blog->getID());
 				break;
 			case 'url':
-				echo $blog->getURL();
+				echo htmlspecialchars($blog->getURL());
 				break;
 			case 'name':
-				echo $blog->getName();
+				echo htmlspecialchars($blog->getName());
 				break;
 			case 'desc':
-				echo $blog->getDescription();
+				echo htmlspecialchars($blog->getDescription());
 				break;
 			case 'short':
-				echo $blog->getShortName();
+				echo htmlspecialchars($blog->getShortName());
 				break; 				
 		}	
 	}
@@ -1121,22 +1121,22 @@
 
 			switch($what) {
 				case 'name':
-					echo $memberinfo->getDisplayName();
+					echo htmlspecialchars($memberinfo->getDisplayName());
 					break;
 				case 'realname':
-					echo $memberinfo->getRealName();
+					echo htmlspecialchars($memberinfo->getRealName());
 					break;
 				case 'notes':
-					echo $memberinfo->getNotes();
+					echo htmlspecialchars($memberinfo->getNotes());
 					break;
 				case 'url':
-					echo $memberinfo->getURL();
+					echo htmlspecialchars($memberinfo->getURL());
 					break;
 				case 'email':
-					echo $memberinfo->getEmail();
+					echo htmlspecialchars($memberinfo->getEmail());
 					break;
 				case 'id':
-					echo $memberinfo->getID();
+					echo htmlspecialchars($memberinfo->getID());
 					break;					
 			}	
 		}
@@ -1146,22 +1146,22 @@
 		{
 			switch($what) {
 				case 'yourname':
-					echo $member->getDisplayName();
+					echo htmlspecialchars($member->getDisplayName());
 					break;
 				case 'yourrealname':
-					echo $member->getRealName();
+					echo htmlspecialchars($member->getRealName());
 					break;
 				case 'yournotes':
-					echo $member->getNotes();
+					echo htmlspecialchars($member->getNotes());
 					break;
 				case 'yoururl':
-					echo $member->getURL();
+					echo htmlspecialchars($member->getURL());
 					break;
 				case 'youremail':
-					echo $member->getEmail();
+					echo htmlspecialchars($member->getEmail());
 					break;
 				case 'yourid':
-					echo $member->getID();
+					echo htmlspecialchars($member->getID());
 					break;									
 			}	
 		}
diff -ruN 3.23/nucleus/libs/globalfunctions.php 3.24/nucleus/libs/globalfunctions.php
--- 3.23/nucleus/libs/globalfunctions.php	2006-05-23 19:50:08.000000000 -0500
+++ 3.24/nucleus/libs/globalfunctions.php	2006-11-29 15:23:33.000000000 -0600
@@ -13,7 +13,7 @@
 /**
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2005 The Nucleus Group
- * @version $Id: globalfunctions.php,v 1.86.2.2 2005/08/15 10:50:12 dekarma Exp $
+ * @version $Id: globalfunctions.php 1104 2006-11-11 10:21:45Z dekarma $
   */
 
 // needed if we include globalfunctions from install.php
@@ -24,7 +24,7 @@
 
 $CONF['debug'] = 0;
 
-$nucleus['version'] = 'v3.23';
+$nucleus['version'] = 'v3.24';
 if (getNucleusPatchLevel() > 0)
 {
 	$nucleus['version'] .= '/' . getNucleusPatchLevel();
@@ -51,7 +51,7 @@
   * returns the currently used version (100 = 1.00, 101 = 1.01, etc...)
   */
 function getNucleusVersion() {
-	return 323;
+	return 324;
 }
 
 /**
