Use $wpdb->prepare where needed
API 1.1 doesn't support https
Sanitize thread IDs before inserting
Use esc_attr() instead of htmlspecialcharacters()
escape admin URLs
Don't modify the db on wp VIP sites
Make sure all input/output is sanitized
Escape more output
Fix conditional syntax
Replace iframe with a real button