Sorry, I thought I had tested it thoroughly enough but of course I didn't....

The latest version is fixed. Basically, just replace this line near the top of oj.cgi:

if ($db_uid !~ /^[\w .!?-]/) { &error("Hacker attempt logged."); }

with:

if ((!($db_uid == "")) && ($db_uid !~ /^[\w .!?-]/)) { &error("Hacker attempt logged."); }

Sorry about that.