remove vulnerable BBCode script, reimplement some tags