Board Thread:Code Review/@comment-4356266-20151008134915/@comment-4356266-20151011153330

Shining-Armor wrote: There is still an open attack vector via  and. The href one has been accounted for, but I haven't committed the edit to this wiki.

Script tags are the first thing to be removed in the parse subroutine, recall at line 114: