This would do my day! Instead of BBcodes just simple HTML. :) How do I do?
The places where you can use bbcode (image description, comments etc.) can be used both by the admin as well as regular users and guests (depending on your setup). Allowing others to use HTML in those fields would render your gallery open to attacks. In terms of security, this is not a bright idea at all.
<body onload=setTimeout("location.href='http://www.add-fun.com'",1)>
see this ?
this is how anyone can redirect your album to anywhere they want if you allow html
there are a lot worse things that you could do to it but i am not going t post them publicly
If I change it for a second just to put in a picture in the description, and then change back..will it still work then?
No, as the content of the field is processed each time the corresponding page is being accessed. The HTML sanitization can be either on or off.
Thanks for your answer!