FIX: BBCode sanitization and tests