Hey Gareth, I'm new too, but hello and welcome to TalkPHP. I had to post because I saw the link to your Simply-BB that you posted, and am quite impressed.

A bit of feedback:
1. As Metz pointed out under feedback, you can use the stripslashes() function when outputting posts without compromising security. But you might have done this already.
2. When you post without all fields filled in, try carrying over the $_POST values that were sent. This way, if I skipped the URL field, I still have my post at hand.

__________________
Programmers are in a race with the Universe to create bigger and better idiot-proof programs, while the Universe is trying to create bigger and better idiots. So far the Universe is winning. - Rich Cook