[lierduh]

A better way to handle html inject will be:

PHP Code:

function bbcodeparser($text = '', $striphtml = true)
{
        global $vbulletin;

        if ($vbulletin->options['shout_bbcode'])
        {
                if ($striphtml)
                {
                        $vbulletin->options['allowhtml'] = false;
                }

                return $vbulletin->vbshout_parse->parse(convert_url_to_bbcode($text), 'nonforum');
        }
        else
        {   
                if ($striphtml)
                {
                        $text = htmlspecialchars_uni($text); 
                }
                return $text;
        }
} 


$vbulletin->options['allowhtml']

Defaults to off when bbcode is used. That is why everyone is getting the > etc. using the latest version.

Basically if one uses bbcode in the shouter. That is no need to worry about html inject because bbcode parser will handle special html tags by default.