editing rating.php and using this:
Code:
$gameid = (int)$_POST['gameid'];
$score = (int)$_POST['score'];
$gameid2 = (int)$_POST['gameid'];
instead of the other variables makes sure people don't exploit that rating.php problem.
search.php, category.php and play.php also have some GET vars vulnerable. updating the .zip packages in a few minutes