Description:
------------
I'm french and I'm 15, so excuse me for my verry verry bad english. I've found an xss fail in mysql_error(). You've just to do a synthax error (whit " in my example) and write your script after the ".

Reproduce code:
---------------
$var = '"<script>alert(\'Hi ! Xss discovered !\')</script>';
$rep = mysql_query('SELECT pseudo FROM membres where pseudo = "'.$var.'"');
if (!$rep)
{
	echo '<br><b>Transmettre aux administrateurs : (via la page contact ou par mp) '.mysql_error().'</b>';
}
else
{
	return $rep;
}