Index: modules/user/user.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/user/user.module,v
retrieving revision 1.708
diff -u -p -r1.708 user.module
--- modules/user/user.module	11 Nov 2006 23:52:11 -0000	1.708
+++ modules/user/user.module	13 Nov 2006 03:17:59 -0000
@@ -1223,6 +1223,8 @@ function user_register_submit($form_id, 
     watchdog('security', t('Detected malicious attempt to alter protected user fields.'), WATCHDOG_WARNING);
     return 'user/register';
   }
+  //the unset below is needed to prevent these form values from being saved as user data
+  unset($form_values['form_token'], $form_values['submit'], $form_values['notify'], $form_values['form_id'], $form_values['affiliates'], $form_values['destination'], $form_values['op']);  
 
   $account = user_save('', array_merge($form_values, array('pass' => $pass, 'init' => $mail, 'roles' => $roles, 'status' => ($admin || variable_get('user_register', 1) == 1))));
   watchdog('user', t('New user: %name %email.', array('%name' => $name, '%email' => '<'. $mail .'>')), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $account->uid .'/edit'));