The src attribute is the {param} not the {option}. You only need url validation on that.
If the url contained a valid bbcode (it is rare but possible), it shouldn't be parsed.