FIX: Hacky fix of #377

Handling [url] before [img] to prevent XSS injection as demonstrated in #377
Merge pull request #380 from mashify/patch-2

FIX: Hacky fix of #377