XSS vs HTML_BBCodeParser

[email protected] ("Daniel O'Connor") Mon, 2 Jan 2012 12:49:47 +1030
Newsgroups php.pear.qa
Message-ID <CAJsZyFChTMoxA+w_XReHnFwav0YgKOChxR2_QnBY+2oTeoxWzA@mail.gmail.com>
Hi all,
http://pear.php.net/bugs/bug.php?id=14579 is one I just stumbled across.
I'd apply the fix described, but no doubt there will be other ways to
subvert it.

Can we take a look and come up with the best way to fix this collectively?