[jscissr]

I think escaping quotes only matters for attributes (which can use ' or "). Example:

    <img src="$url">

Exploit:

    foo.jpg" onload="alert('pwned')

[kuroguro]

Heh, found the exact bug on a live bbcode parser some 5 years ago.

[codedokode]

It was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.