Isn't it quite obvious? You're checking if the string CONTAINS /vips not checking if first 5 letters/the whole string is EQUAL to /vips. Thus allowing people to write /vipsthatsuckd***s.
__________________
Achievements API - a simple way for you to create your OWN custom achievements!