FIX: XSS bug

Called htmlentities on value of textarea to prevent XSS injection.
Example: Someone creates a post with </textarea><script>alert("xss");</script><textarea> in it. Some admin clicks on edit and JavaScript will be executed. (could leak cookie of admin)
FIX: Hacky fix of #377

Handling [url] before [img] to prevent XSS injection as demonstrated in #377
Merge pull request #379 from mashify/patch-1

FIX: XSS bug
Merge pull request #380 from mashify/patch-2

FIX: Hacky fix of #377
Merge branch 'develop'