I quickly realized that the sanitization wasn't quite right here, as this can be abused to link to other pages on the site. This also works when sending messages to other players. Whilst there's some server side filtering of HTML tags, there was one thing that warranted a deeper investigation: when you mention a previous hand in the format #n, it will automatically insert a link to the replay of that hand ( ). Naturally, I spam a bunch of characters in there to see what would happen. One day I browse to the profile page, and notice there's an 'About Me' input field I can control. Nevertheless, people do pay real money to gain more of these chips, so they're not exactly valueless.
This site isn't a real money gambling site, but just a place where you can play Poker with unwithdrawable in-game chips. I've recently started going through a bit of a Poker phase, and have been playing online using the website Replay Poker. How I hacked an online Poker site! Initial publication: March 28th, 2022
