BBCode XSS fix.