CRITICAL: case-sensitive regex allows insertion of malicious code.

The regexes which obtain the <script>, <object> and <embed> are case sensitive. This makes it trivial to bypass the filter and insert arbitrary javascript simply by using <SCRIPT> instead of <script>!

The fix is simple:

change line 228 to:

$input = preg_replace_callback('@<(embed|object|script)([^>]*)/?>?@si', 'embedfilter_process', $input, 5);

change line 231 to:

$input = preg_replace_callback('@<(embed|object|script)([^>]*)>(.*?)@si', 'embedfilter_process', $input, 5);

(note: all we're doing is adding the 'i' flag to the regex statement).

The XSS cheat sheet at http://ha.ckers.org/xss.html is a fantastic resource for familiarizing yourself with current XSS attack techniques. Embed_filter needs to fully sanitize code associated with the object, embed, and script tags, as it opens holes for them.