Oh, the stupidity

[ZiNgA BuRgA]

Most MyCodes don't stick replacements in Javascript, which isn't too bad.

Most MyCodes I've seen, however, are vulnerable to some injection.  MyBB filters out most Javascript (it forgets some events such as onError, onKeyPress etc) and escapes < and > characters, so the worst is often avoided, but people really need to avoid using the (.*?) match.
I tried writing an Easy MyCodes plugin, but it doesn't seem to have attracted much attention.

If MyBB still doesn't filter " characters by the time custom MyCode is parsed, the example in the first post is even worse, as CSS can be injected, eg:

Code:

[tip]aba');" style="position: absolute; left: 0; top: 0; display: block; width: 100%; height: 10000%;" rel="[/tip]

---