So it was an e107 vulnerability?
I have to review some of that registration code, though I have before, but I'm always a little paranoid.
The best solution is to use prepared statements, however, not everyone is using mysqli. I'll have to see if there is some other way around it, but I think it would be difficult this stage in the game.