diff --git a/include/bbcode.php b/include/bbcode.php
index 674c44ec2..f1eb47bd3 100644
--- a/include/bbcode.php
+++ b/include/bbcode.php
@@ -1,78 +1,82 @@
", ">", $Text);
+function bbcode($Text) {
+ // Replace any html brackets with HTML Entities to prevent executing HTML or script
+ // Don't use strip_tags here because it breaks [url] search by replacing & with amp
+ $Text = str_replace("<", "<", $Text);
+ $Text = str_replace(">", ">", $Text);
- // Convert new line chars to html
tags
- $Text = nl2br($Text);
+ // Convert new line chars to html
tags
+ $Text = nl2br($Text);
- // Set up the parameters for a URL search string
- $URLSearchString = " a-zA-Z0-9\:\/\-\?\&\.\=\_\~\#\'";
- // Set up the parameters for a MAIL search string
- $MAILSearchString = $URLSearchString . " a-zA-Z0-9\.@";
+ // Set up the parameters for a URL search string
+ $URLSearchString = " a-zA-Z0-9\:\/\-\?\&\.\=\_\~\#\'";
+ // Set up the parameters for a MAIL search string
+ $MAILSearchString = $URLSearchString . " a-zA-Z0-9\.@";
- // Perform URL Search
- $Text = preg_replace("/\[url\]([$URLSearchString]*)\[\/url\]/", '$1', $Text);
- $Text = preg_replace("(\[url\=([$URLSearchString]*)\](.+?)\[/url\])", '$2', $Text);
- //$Text = preg_replace("(\[url\=([$URLSearchString]*)\]([$URLSearchString]*)\[/url\])", '$2', $Text);
+ // Perform URL Search
+ $Text = preg_replace("/\[url\]([$URLSearchString]*)\[\/url\]/", '$1', $Text);
+ $Text = preg_replace("(\[url\=([$URLSearchString]*)\](.+?)\[/url\])", '$2', $Text);
+ //$Text = preg_replace("(\[url\=([$URLSearchString]*)\]([$URLSearchString]*)\[/url\])", '$2', $Text);
- // Perform MAIL Search
- $Text = preg_replace("(\[mail\]([$MAILSearchString]*)\[/mail\])", '$1', $Text);
- $Text = preg_replace("/\[mail\=([$MAILSearchString]*)\](.+?)\[\/mail\]/", '$2', $Text);
+ // Perform MAIL Search
+ $Text = preg_replace("(\[mail\]([$MAILSearchString]*)\[/mail\])", '$1', $Text);
+ $Text = preg_replace("/\[mail\=([$MAILSearchString]*)\](.+?)\[\/mail\]/", '$2', $Text);
- // Check for bold text
- $Text = preg_replace("(\[b\](.+?)\[\/b])is",'$1',$Text);
+ // Check for bold text
+ $Text = preg_replace("(\[b\](.+?)\[\/b])is",'$1',$Text);
- // Check for Italics text
- $Text = preg_replace("(\[i\](.+?)\[\/i\])is",'$1',$Text);
+ // Check for Italics text
+ $Text = preg_replace("(\[i\](.+?)\[\/i\])is",'$1',$Text);
- // Check for Underline text
- $Text = preg_replace("(\[u\](.+?)\[\/u\])is",'$1',$Text);
+ // Check for Underline text
+ $Text = preg_replace("(\[u\](.+?)\[\/u\])is",'$1',$Text);
- // Check for strike-through text
- $Text = preg_replace("(\[s\](.+?)\[\/s\])is",'$1',$Text);
+ // Check for strike-through text
+ $Text = preg_replace("(\[s\](.+?)\[\/s\])is",'$1',$Text);
- // Check for over-line text
- $Text = preg_replace("(\[o\](.+?)\[\/o\])is",'$1',$Text);
+ // Check for over-line text
+ $Text = preg_replace("(\[o\](.+?)\[\/o\])is",'$1',$Text);
- // Check for colored text
- $Text = preg_replace("(\[color=(.+?)\](.+?)\[\/color\])is","$2",$Text);
+ // Check for colored text
+ $Text = preg_replace("(\[color=(.+?)\](.+?)\[\/color\])is","$2",$Text);
- // Check for sized text
- $Text = preg_replace("(\[size=(.+?)\](.+?)\[\/size\])is","$2",$Text);
+ // Check for sized text
+ $Text = preg_replace("(\[size=(.+?)\](.+?)\[\/size\])is","$2",$Text);
- // Check for list text
- $Text = preg_replace("/\[list\](.+?)\[\/list\]/is", '
$1
';
- // Check for [code] text
- $Text = preg_replace("/\[code\](.+?)\[\/code\]/is","$CodeLayout", $Text);
- // Declare the format for [quote] layout
- $QuoteLayout = '$1'; - // Check for [quote] text - $Text = preg_replace("/\[quote\](.+?)\[\/quote\]/is","$QuoteLayout", $Text); + // Declare the format for [code] layout + $CodeLayout = '
$1
';
+ // Check for [code] text
+ $Text = preg_replace("/\[code\](.+?)\[\/code\]/is","$CodeLayout", $Text);
+ // Declare the format for [quote] layout
+ $QuoteLayout = '$1'; + // Check for [quote] text + $Text = preg_replace("/\[quote\](.+?)\[\/quote\]/is","$QuoteLayout", $Text); - // Images - // [img]pathtoimage[/img] - $Text = preg_replace("/\[img\](.+?)\[\/img\]/", '