[Cruze]

Originally Posted by 1337norway DON'T EVER DO THIS! Parsing a variable that a user can define into a ServerCommand function without sanitizing the string is very dangerous because it's exploitable. If the user set his name to ";quit" for example, the console command input would be "sm_hp ;quit", which would end the servers process. Or even worse they can have a name like ";rcon_password newpass" and the server will change the password so the attacker could have direct control over the server.

that was informative! Thanks!!

[Powerlord]

If you are going to pass a user to another command, do it using their userid instead. Something like

PHP Code:

ServerCommand("sm_whatever #%d", GetClientUserId(client)); 


The # tells commands that use FindTarget / ProcessTargetString to treat the value that follows it as a userid.