[Brad]

Yes my update fixes that issue, although it does not restrict input to NOHTML, it simply cleans it when it's called from the database.

Brad's update didn't fix the current problems

My update fixed only one problem and that was allowing users to inject html.

Why are you using htmlspecialchars() as the 'fix' function? That only causes special chars to get converted... why not use strip_tags() ?

Strip_tags will give you results that are just as bad. For example try posting this in the shoutbox "& <-- no &amp;" this will display "&" because everything after < is stripped.

Update

I've uploaded a new version of this hack, dubbed '2.0.2'. This one should fix the issues without breaking special characters. To upgrade, download the new zip file and upload the new vbshout.php file.

Please note that this only fixes the html injection issues. I do not use this hack on my own forum (although I've tested this on a client's board) so I will not be fixing the server load issues. I suggest you do not install this hack if you can't deal with the extra server load, as it's rather intensive.