Fix oscommerce hack

There may already be a fix for this, I havent checked. In oscommerce at checkout you can replace [login to view URL] url to [login to view URL] and the order is recorded on the site and looks like real order, untill you check for payment obviuously. I'm looking for a service provider to make this hack imposible on our test store. Very small budget pls, easy project for someone