Fixed IMG BBCode

Fixed IMG BBCode RCE and CSRF vulnerability