01-22-2008, 10:47 PM
|
#45 (permalink)
|
|
The Acquainted
Join Date: Nov 2007
Posts: 166
Thanks: 0
|
PHP Code:
if (eregi('http://', $message)){
$message = preg_replace("#\[url\](.*?)\[/url\]#is", '<a href="\\1" target=_blank>\\1</a>', $message);
$message = preg_replace("#\[url=$any\]$any\[/url\]#is", "<a href=\"\\1\" target=_blank>\\2</a>", $message);
} else {
$message = preg_replace("#\[url\](.*?)\[/url\]#is", '<a href="http://\\1" target=_blank>\\1</a>', $message);
$message = preg_replace("#\[url=$any\]$any\[/url\]#is", "<a href=\"http://\\1\" target=_blank>\\2</a>", $message);
}
You've got some XSS there. Probably in some of the other areas of your BBCode as well. Couldn't tell you without some testing though.
__________________
Eric
|
|
|
|