uf/includes/pms/pms_write.php

<?php

$msg ='';

if ((isset($_POST['textedit'])) and (isset($_POST['nmsg'])) and (isset($_POST['username'])))
{
	if (($_POST['textedit'] != '') and ($_POST['nmsg']!='') and ($_POST['username']!='') and (strlen($_POST['textedit'])>10) and (strlen($_POST['nmsg'])>5))
	{
		$nick = strip_tags($_POST['username']);
		$sql = "SELECT * FROM `".USERS_TABLE."` WHERE `nick`='$nick'";
		$result = DataBase::fetch(DataBase::sql_query($sql, CRITICAL,'Could not obtain user information.'));
		if ($result['u_id']!='')
		{
			$_POST['textedit'] = Secure::TagsReplace($_POST['textedit']);
			$_POST['nmsg'] = strip_tags($_POST['nmsg']);
			Pms::SendMessage($_POST['textedit'],$_POST['nmsg'], $_POST['username']);
			message_forum($lng['post_is_saved'],'pms.php');
		}
		else
		{
			$message =  $lng['no_user'];
			$msg = './skins/'.$default_skin.'/post_error_body.tpl';
		}
	}
	else
	{
		$message =  $lng['perror_1'];
		$msg = './skins/'.$default_skin.'/post_error_body.tpl';
	}
}
else
{
	if (isset($_GET['id']))
	{
		Secure::user_exists(intval($_GET['id']));
		$_POST['username'] = User::UserInformation(intval($_GET['id']), 'nick');
	}
	else
	{
		$_POST['username'] = '';
	}
	$_POST['nmsg']='';
	$_POST['textedit']='';
}
//add skin variables
$skin = array(
'smiles'=>Post::SmilesShow(),
//labels
'luser'=>$lng['user'],
'lsmiles'=>$lng['smiles'],
'lmsgname'=>$lng['msgname'],
'lmsg'=>$lng['message'],
'lsave'=>$lng['save'],
'lreset'=>$lng['reset'],
'lwritemsg'=>$lng['write_pm'],
'action'=>$_SERVER['REQUEST_URI']
);

$skin = array_push_assoc($skin, GenerateHeader($lng['lpm'].': '.$lng['write_pm'], '</a>&gt;<a href="pms.php" class="navigator">'.$lng['lpm'].'</a> &gt; <a href="'.$_SERVER['REQUEST_URI'].'" class="navigator">'.$lng['write_pm']));

if ($msg=='')
{
	$msg='./skins/'.$default_skin.'/blank.tpl';
}

//do it!
include('./skins/'.$default_skin.'/overall_header.tpl');
include('./skins/'.$default_skin.'/msgs_new_body.tpl');

if(RANK=='2')
{
	$skin['pa_link']='<a href="admin/index.php" class="fsmall"><b>'.$lng['pa_link'].'</b></a>';
}
else
{
	$skin['pa_link']='';
}

$stop = TimeGeneration();
$skin['queries'] =  ShowQueries($start, $stop);
include('./skins/'.$default_skin.'/overall_footer.tpl'); 

?>