- $text = preg_replace("/([#])\[url\=([$URLSearchString]*)\](.*?)\[\/url\]/ism",
- '$1<a href="' . System::baseUrl() . '/search?tag=$3" class="tag" title="$3">$3</a>', $text);
-
- $text = preg_replace("/\[url\=([$URLSearchString]*)\]#(.*?)\[\/url\]/ism",
- '#<a href="' . System::baseUrl() . '/search?tag=$2" class="tag" title="$2">$2</a>', $text);
+ /* Tag conversion
+ * Supports:
+ * - #[url=<anything>]<term>[/url]
+ * - [url=<anything>]#<term>[/url]
+ */
+ $text = preg_replace_callback("/(?:#\[url\=[$URLSearchString]*\]|\[url\=[$URLSearchString]*\]#)(.*?)\[\/url\]/ism", function($matches) {
+ return '#<a href="'
+ . System::baseUrl() . '/search?tag=' . rawurlencode($matches[1])
+ . '" class="tag" title="' . XML::escape($matches[1]) . '">'
+ . XML::escape($matches[1])
+ . '</a>';
+ }, $text);