this BBCode XSS just flew over us again. (credit goes to Silvea12 for this c:)