XF 1.3 text inside of a url

[Robby]

Could it pose a security issue to use {text} inside of a URL? I'm trying to embed wikipedia. @JoshyPHP wasn't sure about this in this previous threat: http://xenforo.com/community/threads/s9e-media-bbcodes-pack-★★★★★.61883/page-25

 

[Mike]

In theory, you could possibly trigger some weird behaviors if there were nested HTML tags, because you'd be in an attribute context. If you disable BB codes within, you likely won't have that specific problem, but the value isn't escaped for a URL context so it's possible to do some other potentially unexpected things.

You could of course use a callback.