FIX: Hacky fix of #377

Handling [url] before [img] to prevent XSS injection as demonstrated in #377