Due to a recent security hole found in PHPX, here is a patch:

 in /includes/functions.inc.php lines 75 to 89 is the function checkCookie().  In this function change the line:

list($user_id, $username) = $this->core->db->fetch("select user_id, username from 
 users where sess = '$_COOKIE[PXL]'");

list($user_id, $username) = $this->core->db->fetch("select user_id,
 username from users where sess = '" . htmlspecialchars($_COOKIE[PXL]) . "'");

That will plug this hole.