13 files changed, 308 insertions, 200 deletions
diff --git a/phpBB/includes/bbcode.php b/phpBB/includes/bbcode.php
index f9b8fcbce3..4e56a2be77 100644
--- a/phpBB/includes/bbcode.php
+++ b/phpBB/includes/bbcode.php
@@ -257,10 +257,12 @@ class bbcode
 					}
 				break;
 				case 12:
-					$this->bbcode_cache[$bbcode_id] = array('preg' => array(
-						'#\[attachment=([0-9]+):$uid\]#'	=>	$this->bbcode_tpl('inline_attachment_open', $bbcode_id),
-						'#\[\/attachment:$uid\]#'	=>	$this->bbcode_tpl('inline_attachment_close', $bbcode_id)
-					));
+					$this->bbcode_cache[$bbcode_id] = array(
+						'str'	=> array(
+							'[/attachment:$uid]'	=> $this->bbcode_tpl('inline_attachment_close', $bbcode_id)),
+						'preg'	=> array(
+							'#\[attachment=([0-9]+):$uid\]#'	=> $this->bbcode_tpl('inline_attachment_open', $bbcode_id))
+					);
 					break;
 				default:
 					if (isset($rowset[$bbcode_id]))
@@ -461,23 +463,22 @@ class bbcode
 		switch ($type)
 		{
 			case 'php':
+				// Not the english way, but valid because of hardcoded syntax highlighting
+				if (strpos($code, '<span class="syntaxdefault"><br /></span>') === 0)
+				{
+					$code = substr($code, 41);
+				}
+
 			default:
 				$code = str_replace("\t", '&nbsp; &nbsp;', $code);
 				$code = str_replace('  ', '&nbsp; ', $code);
 				$code = str_replace('  ', ' &nbsp;', $code);
 
-				$match = array(
-					'#<!\-\- e \-\-><a href="mailto:(.*?)">.*?</a><!\-\- e \-\->#',
-					'#<!\-\- m \-\-><a href="(.*?)" target="_blank">.*?</a><!\-\- m \-\->#',
-					'#<!\-\- w \-\-><a href="http:\/\/(.*?)" target="_blank">.*?</a><!\-\- w \-\->#',
-					'#<!\-\- l \-\-><a href="(.*?)" target="_blank">.*?</a><!\-\- l \-\->#',
-					'#<!\-\- s(.*?) \-\-><img src="\{SMILE_PATH\}\/.*? \/><!\-\- s\1 \-\->#',
-					'#^[\n]#'
-				);
-	
-				$replace = array('\1', '\1', '\1', '\1', '\1', '');
-				
-				$code = preg_replace($match, $replace, $code);
+				// remove newline at the beginning
+				if ($code{0} == "\n")
+				{
+					$code = substr($code, 1);
+				}
 		}
 
 		$code = $this->bbcode_tpl('code_open') . $code . $this->bbcode_tpl('code_close');
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index 33dd4f2295..6589f804bd 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -118,7 +118,7 @@ function get_userdata($user)
 }
 
 // Create forum rules for given forum
-function generate_forum_rules($forum_data)
+function generate_forum_rules(&$forum_data)
 {
 	if (!$forum_data['forum_rules'] && !$forum_data['forum_rules_link'])
 	{
@@ -750,7 +750,8 @@ function markread($mode, $forum_id = 0, $topic_id = 0, $marktime = false)
 
 
 // Pagination routine, generates page number sequence
-function generate_pagination($base_url, $num_items, $per_page, $start_item, $add_prevnext_text = TRUE)
+// tpl_prefix is for using different pagination blocks at one page
+function generate_pagination($base_url, $num_items, $per_page, $start_item, $add_prevnext_text = true, $tpl_prefix = '')
 {
 	global $template, $user;
 
@@ -765,7 +766,7 @@ function generate_pagination($base_url, $num_items, $per_page, $start_item, $add
 
 	$on_page = floor($start_item / $per_page) + 1;
 
-	$page_string = ($on_page == 1) ? '<strong>1</strong>' : '<a href="' . $base_url . "&amp;start=" . (($on_page - 2) * $per_page) . '">' . $user->lang['PREVIOUS'] . '</a>&nbsp;&nbsp;<a href="' . $base_url . '">1</a>';
+	$page_string = ($on_page == 1) ? '<strong>1</strong>' : '<a href="' . $base_url . '">1</a>';
 
 	if ($total_pages > 5)
 	{
@@ -799,13 +800,17 @@ function generate_pagination($base_url, $num_items, $per_page, $start_item, $add
 		}
 	}
 
-	$page_string .= ($on_page == $total_pages) ? '<strong>' . $total_pages . '</strong>' : '<a href="' . $base_url . '&amp;start=' . (($total_pages - 1) * $per_page) . '">' . $total_pages . '</a>&nbsp;&nbsp;<a href="' . $base_url . "&amp;start=" . ($on_page * $per_page) . '">' . $user->lang['NEXT'] . '</a>';
-
+	$page_string .= ($on_page == $total_pages) ? '<strong>' . $total_pages . '</strong>' : '<a href="' . $base_url . '&amp;start=' . (($total_pages - 1) * $per_page) . '">' . $total_pages . '</a>';
 //	$page_string = $user->lang['GOTO_PAGE'] . ' ' . $page_string;
-	$page_string = '<a href="javascript:jumpto();">' . $user->lang['GOTO_PAGE'] . '</a> ' . $page_string;
+//	$page_string = '<a href="javascript:jumpto();">' . $user->lang['GOTO_PAGE'] . '</a> ' . $page_string;
 
-	$template->assign_var('BASE_URL', $base_url);
-	$template->assign_var('PER_PAGE', $per_page);
+	$template->assign_vars(array(
+		$tpl_prefix . 'BASE_URL'	=> $base_url,
+		$tpl_prefix . 'PER_PAGE'	=> $per_page,
+		
+		$tpl_prefix . 'PREVIOUS_PAGE'	=> ($on_page == 1) ? '' : $base_url . '&amp;start=' . (($on_page - 2) * $per_page),
+		$tpl_prefix . 'NEXT_PAGE'	=> ($on_page == $total_pages) ? '' : $base_url . '&amp;start=' . ($on_page * $per_page))
+	);
 
 	return $page_string;
 }
@@ -1005,7 +1010,7 @@ function redirect($url)
 	$url = str_replace('&amp;', '&', $url);
 
 	// Local redirect? If not, prepend the boards url
-	$url = (!strstr($url, '://')) ? (generate_board_url() . preg_replace('#^/?(.*?)/?$#', '/\1', trim($url))) : $url;
+	$url = (strpos($url, '://') === false) ? (generate_board_url() . preg_replace('#^/?(.*?)/?$#', '/\1', trim($url))) : $url;
 
 	// Redirect via an HTML form for PITA webservers
 	if (@preg_match('#Microsoft|WebSTAR|Xitami#', getenv('SERVER_SOFTWARE')))
@@ -1165,7 +1170,7 @@ function login_box($redirect = '', $l_explain = '', $l_success = '', $admin = fa
 		'U_PRIVACY'			=> "{$phpbb_root_path}ucp.$phpEx$SID&amp;mode=privacy",
 
 		'S_DISPLAY_FULL_LOGIN'	=> ($s_display) ? true : false,
-		'S_LOGIN_ACTION'		=> $redirect_page,
+		'S_LOGIN_ACTION'		=> (!$admin) ? "{$phpbb_root_path}ucp.$phpEx$SID&amp;mode=login" : "index.$phpEx$SID",
 		'S_HIDDEN_FIELDS' 		=> $s_hidden_fields)
 	);
 
@@ -1303,6 +1308,38 @@ function smilie_text($text, $force_option = false)
 	return ($force_option || !$config['allow_smilies'] || !$user->optionget('viewsmilies')) ? preg_replace('#<!\-\- s(.*?) \-\-><img src="\{SMILE_PATH\}\/.*? \/><!\-\- s\1 \-\->#', '\1', $text) : str_replace('<img src="{SMILE_PATH}', '<img src="' . $phpbb_root_path . $config['smilies_path'], $text);
 }
 
+// Inline Attachment processing
+function parse_inline_attachments(&$text, &$attachments, &$update_count, $forum_id = 0, $preview = false)
+{
+	global $config, $user;
+
+	$attachments = display_attachments($forum_id, NULL, $attachments, $update_count, $preview, true);
+	$tpl_size = sizeof($attachments);
+
+	$unset_tpl = array();
+
+	preg_match_all('#<!\-\- ia([0-9]+) \-\->(.*?)<!\-\- ia\1 \-\->#', $text, $matches, PREG_PATTERN_ORDER);
+
+	$replace = array();
+	foreach ($matches[0] as $num => $capture)
+	{
+		// Flip index if we are displaying the reverse way
+		$index = ($config['display_order']) ? ($tpl_size-($matches[1][$num] + 1)) : $matches[1][$num];
+
+		$replace['from'][] = $matches[0][$num];
+		$replace['to'][] = (isset($attachments[$index])) ? $attachments[$index] : sprintf($user->lang['MISSING_INLINE_ATTACHMENT'], $matches[2][array_search($index, $matches[1])]);
+
+		$unset_tpl[] = $index;
+	}
+
+	if (isset($replace['from']))
+	{
+		$text = str_replace($replace['from'], $replace['to'], $text);
+	}
+
+	return array_unique($unset_tpl);
+}
+
 // Check if extension is allowed to be posted within forum X (forum_id 0 == private messaging)
 function extension_allowed($forum_id, $extension)
 {
@@ -1351,6 +1388,7 @@ function msg_handler($errno, $msg_text, $errfile, $errline)
 		case E_WARNING:
 			if (defined('DEBUG_EXTRA'))
 			{
+				// Remove me
 				if (!strstr($errfile, '/cache/') && !strstr($errfile, 'mysql.php') && !strstr($errfile, 'template.php'))
 				{
 					echo "<b>PHP Notice</b>: in file <b>$errfile</b> on line <b>$errline</b>: <b>$msg_text</b><br>";
@@ -1430,6 +1468,7 @@ function msg_handler($errno, $msg_text, $errfile, $errline)
 			exit;
 			break;
 
+/*		remove me
 		default:
 			if (defined('DEBUG_EXTRA'))
 			{
@@ -1438,7 +1477,7 @@ function msg_handler($errno, $msg_text, $errfile, $errline)
 					echo "<b>Another Error</b>: in file <b>$errfile</b> on line <b>$errline</b>: <b>$msg_text</b><br>";
 				}
 			}
-			break;
+			break;*/
 	}
 }
 
@@ -1732,21 +1771,23 @@ function page_footer()
 			$db->sql_report('display');
 		}
 
-		$debug_output = sprintf('Time : %.3fs | ' . $db->sql_num_queries() . ' Queries | GZIP : ' .  ( ( $config['gzip_compress'] ) ? 'On' : 'Off' ) . ' | Load : '  . (($user->load) ? $user->load : 'N/A'), $totaltime);
+		$debug_output = sprintf('Time : %.3fs | ' . $db->sql_num_queries() . ' Queries | GZIP : ' .  (($config['gzip_compress']) ? 'On' : 'Off' ) . ' | Load : '  . (($user->load) ? $user->load : 'N/A'), $totaltime);
 
-		if ($auth->acl_get('a_'))
+		if ($auth->acl_get('a_') && defined('DEBUG_EXTRA'))
 		{
 			if (function_exists('memory_get_usage'))
 			{
 				if ($memory_usage = memory_get_usage())
 				{
+					global $base_memory_usage;
+					$memory_usage -= $base_memory_usage;
 					$memory_usage = ($memory_usage >= 1048576) ? round((round($memory_usage / 1048576 * 100) / 100), 2) . ' ' . $user->lang['MB'] : (($memory_usage >= 1024) ? round((round($memory_usage / 1024 * 100) / 100), 2) . ' ' . $user->lang['KB'] : $memory_usage . ' ' . $user->lang['BYTES']);
 			
 					$debug_output .= ' | Memory Usage: ' . $memory_usage;	
 				}
 			}
 
-			$debug_output .= ' | <a href="' . (($_SERVER['REQUEST_URI']) ? htmlspecialchars($_SERVER['REQUEST_URI']) : "index.$phpEx$SID") . ((strstr($_SERVER['REQUEST_URI'], '?')) ? '&amp;' : '?') . 'explain=1">Explain</a>';
+			$debug_output .= ' | <a href="' . (($_SERVER['REQUEST_URI']) ? htmlspecialchars($_SERVER['REQUEST_URI']) : "index.$phpEx$SID") . ((strpos($_SERVER['REQUEST_URI'], '?') !== false) ? '&amp;' : '?') . 'explain=1">Explain</a>';
 		}
 	}
 
diff --git a/phpBB/includes/functions_admin.php b/phpBB/includes/functions_admin.php
index 097a7769fc..2ffda2ac72 100644
--- a/phpBB/includes/functions_admin.php
+++ b/phpBB/includes/functions_admin.php
@@ -81,7 +81,7 @@ function size_select($select_name, $size_compare)
 
 	$select_field = '<select name="' . $select_name . '">';
 
-	for ($i = 0; $i < count($size_types_text); $i++)
+	for ($i = 0, $size = sizeof($size_types_text); $i < $size; $i++)
 	{
 		$selected = ($size_compare == $size_types[$i]) ? ' selected="selected"' : '';
 		$select_field .= '<option value="' . $size_types[$i] . '"' . $selected . '>' . $size_types_text[$i] . '</option>';
@@ -1479,9 +1479,9 @@ function remove_comments(&$output)
 }
 
 // remove_remarks will strip the sql comment lines out of an uploaded sql file
-function remove_remarks($sql)
+function remove_remarks(&$sql)
 {
-	return preg_replace('/(\n){2,}/', "\n", preg_replace('/^#.*/m', "\n", $sql));
+	preg_replace('/(\n){2,}/', "\n", preg_replace('/^#.*/m', "\n", $sql));
 }
 
 // split_sql_file will split an uploaded sql file into single sql statements.
diff --git a/phpBB/includes/functions_display.php b/phpBB/includes/functions_display.php
index 516f38aa6d..71c76b24f6 100644
--- a/phpBB/includes/functions_display.php
+++ b/phpBB/includes/functions_display.php
@@ -66,7 +66,7 @@ function display_forums($root_data = '', $display_moderators = TRUE)
 
 	while ($row = $db->sql_fetchrow($result))
 	{
-		if ($mark_read == 'forums' && $userdata['user_id'] != ANONYMOUS)
+		if ($mark_read == 'forums' && $user->data['user_id'] != ANONYMOUS)
 		{
 			if ($auth->acl_get('f_list', $row['forum_id']))
 			{
@@ -172,7 +172,7 @@ function display_forums($root_data = '', $display_moderators = TRUE)
 		$redirect = (!empty($_SERVER['REQUEST_URI'])) ? preg_replace('#^(.*?)&(amp;)?mark=.*$#', '\1', htmlspecialchars($_SERVER['REQUEST_URI'])) : "index.$phpEx$SID";
 		meta_refresh(3, $redirect);
 
-		$message = (strstr($redirect, 'viewforum')) ? 'RETURN_FORUM' : 'RETURN_INDEX';
+		$message = (strpos($redirect, 'viewforum') !== false) ? 'RETURN_FORUM' : 'RETURN_INDEX';
 		$message = $user->lang['FORUMS_MARKED'] . '<br /><br />' . sprintf($user->lang[$message], '<a href="' . $redirect . '">', '</a> ');
 		trigger_error($message);
 	}
@@ -341,7 +341,7 @@ function display_forums($root_data = '', $display_moderators = TRUE)
 }
 
 // Display Attachments
-function display_attachments($forum_id, $blockname, $attachment_data, &$update_count, $force_physical = false, $return = false)
+function display_attachments($forum_id, $blockname, &$attachment_data, &$update_count, $force_physical = false, $return = false)
 {
 	global $extensions, $template, $cache, $attachment_tpl;
 	global $config, $user, $phpbb_root_path, $phpEx, $SID;
@@ -350,7 +350,7 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 //	$starttime = $starttime[1] + $starttime[0];
 	$return_tpl = array();
 
-	$blocks = array(WM_CAT => 'WM_STREAM', RM_CAT => 'RM_STREAM', THUMB_CAT => 'THUMBNAIL', IMAGE_CAT => 'IMAGE');
+	$blocks = array(ATTACHMENT_CATEGORY_WM => 'WM_STREAM', ATTACHMENT_CATEGORY_RM => 'RM_STREAM', ATTACHMENT_CATEGORY_THUMB => 'THUMBNAIL', ATTACHMENT_CATEGORY_IMAGE => 'IMAGE');
 
 	if (!isset($attachment_tpl))
 	{
@@ -454,11 +454,11 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 				
 			$display_cat = $extensions[$attachment['extension']]['display_cat'];
 
-			if ($display_cat == IMAGE_CAT)
+			if ($display_cat == ATTACHMENT_CATEGORY_IMAGE)
 			{
 				if ($attachment['thumbnail'])
 				{
-					$display_cat = THUMB_CAT;
+					$display_cat = ATTACHMENT_CATEGORY_THUMB;
 				}
 				else
 				{
@@ -468,12 +468,12 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 						{
 							list($width, $height) = getimagesize($filename);
 
-							$display_cat = (!$width && !$height) ? IMAGE_CAT : (($width <= $config['img_link_width'] && $height <= $config['img_link_height']) ? IMAGE_CAT : NONE_CAT);
+							$display_cat = (!$width && !$height) ? ATTACHMENT_CATEGORY_IMAGE : (($width <= $config['img_link_width'] && $height <= $config['img_link_height']) ? ATTACHMENT_CATEGORY_IMAGE : ATTACHMENT_CATEGORY_NONE);
 						}
 					}
 					else
 					{
-						$display_cat = NONE_CAT;
+						$display_cat = ATTACHMENT_CATEGORY_NONE;
 					}
 				}
 			}
@@ -481,7 +481,7 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 			switch ($display_cat)
 			{
 				// Images
-				case IMAGE_CAT:
+				case ATTACHMENT_CATEGORY_IMAGE:
 					$img_source = $filename;
 					$update_count[] = $attachment['attach_id'];
 
@@ -490,7 +490,7 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 					break;
 					
 				// Images, but display Thumbnail
-				case THUMB_CAT:
+				case ATTACHMENT_CATEGORY_THUMB:
 					$thumb_source = $thumbnail_filename;
 
 					$l_downloaded_viewed = $user->lang['VIEWED'];
@@ -501,7 +501,7 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 					break;
 
 				// Windows Media Streams
-				case WM_CAT:
+				case ATTACHMENT_CATEGORY_WM:
 					$l_downloaded_viewed = $user->lang['VIEWED'];
 					$download_link = $filename;
 
@@ -510,7 +510,7 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 					break;
 
 				// Real Media Streams
-				case RM_CAT:
+				case ATTACHMENT_CATEGORY_RM:
 					$l_downloaded_viewed = $user->lang['VIEWED'];
 					$download_link = $filename;
 
@@ -545,7 +545,7 @@ function display_attachments($forum_id, $blockname, $attachment_data, &$update_c
 					break;
 			}
 
-			$l_download_count = ($attachment['download_count'] == 0) ? $user->lang['DOWNLOAD_NONE'] : (($attachment['download_count'] == 1) ? sprintf($user->lang['DOWNLOAD_COUNT'], $attachment['download_count']) : sprintf($user->lang['DOWNLOAD_COUNTS'], $attachment['download_count']));
+			$l_download_count = (!isset($attachment['download_count']) || $attachment['download_count'] == 0) ? $user->lang['DOWNLOAD_NONE'] : (($attachment['download_count'] == 1) ? sprintf($user->lang['DOWNLOAD_COUNT'], $attachment['download_count']) : sprintf($user->lang['DOWNLOAD_COUNTS'], $attachment['download_count']));
 
 			$current_block = ($display_cat) ? $blocks[$display_cat] : 'FILE';
 			
diff --git a/phpBB/includes/functions_posting.php b/phpBB/includes/functions_posting.php
index c44d539716..5946183b21 100644
--- a/phpBB/includes/functions_posting.php
+++ b/phpBB/includes/functions_posting.php
@@ -149,9 +149,9 @@ function upload_attachment($forum_id, $filename, $local = false, $local_storage
 	$filedata['mimetype'] = (!$local) ? $_FILES['fileupload']['type'] : 'application/octet-stream';
 		
 	// Opera adds the name to the mime type
-	$filedata['mimetype']	= (strstr($filedata['mimetype'], '; name')) ? str_replace(strstr($filedata['mimetype'], '; name'), '', $filedata['mimetype']) : $filedata['mimetype'];
+	$filedata['mimetype']	= (strpos($filedata['mimetype'], '; name') !== false) ? str_replace(strstr($filedata['mimetype'], '; name'), '', $filedata['mimetype']) : $filedata['mimetype'];
 	$filedata['extension']	= array_pop(explode('.', strtolower($filename)));
-	$filedata['filesize']	= (!@filesize($file)) ? intval($_FILES['size']) : @filesize($file);
+	$filedata['filesize']	= (!@filesize($file)) ? (int) $_FILES['size'] : @filesize($file);
 
 	$extensions = array();
 	obtain_attach_extensions($extensions);
@@ -187,7 +187,7 @@ function upload_attachment($forum_id, $filename, $local = false, $local_storage
 	}
 
 	// Check Image Size, if it is an image
-	if (!$auth->acl_gets('m_', 'a_') && $cat_id == IMAGE_CAT)
+	if (!$auth->acl_gets('m_', 'a_') && $cat_id == ATTACHMENT_CATEGORY_IMAGE)
 	{
 		list($width, $height) = getimagesize($file);
 
@@ -248,7 +248,7 @@ function upload_attachment($forum_id, $filename, $local = false, $local_storage
 	$filedata['filename'] = str_replace("'", "\'", $filedata['filename']);
 			
 	// Do we have to create a thumbnail ?
-	if ($cat_id == IMAGE_CAT && $config['img_create_thumbnail'])
+	if ($cat_id == ATTACHMENT_CATEGORY_IMAGE && $config['img_create_thumbnail'])
 	{
 		$filedata['thumbnail'] = 1;
 	}
@@ -491,44 +491,22 @@ function decode_message(&$message, $bbcode_uid = '')
 {
 	global $config;
 
-	$server_protocol = ($config['cookie_secure']) ? 'https://' : 'http://';
-	$server_port = ($config['server_port'] <> 80) ? ':' . trim($config['server_port']) . '/' : '/';
-
 	$match = array('<br />', "[/*:m:$bbcode_uid]", ":u:$bbcode_uid", ":o:$bbcode_uid", ":$bbcode_uid");
 	$replace = array("\n", '', '', '', '');
 
 	$message = ($bbcode_uid) ? str_replace($match, $replace, $message) : str_replace('<br />', "\n", $message);
 
-	// HTML
-	if ($config['allow_html_tags'])
-	{
-		// If $html is true then "allowed_tags" are converted back from entity
-		// form, others remain
-		$allowed_tags = split(',', $config['allow_html_tags']);
-			
-		if (sizeof($allowed_tags))
-		{
-			$message = preg_replace('#\<(\/?)(' . str_replace('*', '.*?', implode('|', $allowed_tags)) . ')\>#is', '&lt;$1$2&gt;', $message);
-		}
-	}
-
 	$match = array(
 		'#<!\-\- e \-\-><a href="mailto:(.*?)">.*?</a><!\-\- e \-\->#',
 		'#<!\-\- m \-\-><a href="(.*?)" target="_blank">.*?</a><!\-\- m \-\->#',
 		'#<!\-\- w \-\-><a href="http:\/\/(.*?)" target="_blank">.*?</a><!\-\- w \-\->#',
 		'#<!\-\- l \-\-><a href="(.*?)" target="_blank">.*?</a><!\-\- l \-\->#',
 		'#<!\-\- s(.*?) \-\-><img src="\{SMILE_PATH\}\/.*? \/><!\-\- s\1 \-\->#',
+		'#<!\-\- h \-\-><(.*?)><!\-\- h \-\->#',
 		'#<.*?>#s'
 	);
 	
-	$replace = array(
-		'\1',
-		'\1',
-		'\1',
-		$server_protocol . trim($config['server_name']) . $server_port . preg_replace('#^\/?(.*?)(\/)?$#', '\1', trim($config['script_path'])) . '/\1',
-		'\1',
-		''
-	);
+	$replace = array('\1', '\1', '\1', '\1', '\1', '&lt;\1&gt;', '');
 	
 	$message = preg_replace($match, $replace, $message);
 
@@ -595,7 +573,7 @@ function posting_gen_topic_icons($mode, $icon_id)
 }
 
 // Assign Inline attachments (build option fields)
-function posting_gen_inline_attachments($attachment_data)
+function posting_gen_inline_attachments(&$attachment_data)
 {
 	global $template;
 
@@ -672,7 +650,7 @@ function posting_gen_topic_types($forum_id, $cur_topic_type = POST_NORMAL)
 	return $toggle;
 }
 
-function posting_gen_attachment_entry($attachment_data, $filename_data)
+function posting_gen_attachment_entry(&$attachment_data, &$filename_data)
 {
 	global $template, $config, $phpbb_root_path, $SID, $phpEx;
 		
diff --git a/phpBB/includes/functions_privmsgs.php b/phpBB/includes/functions_privmsgs.php
index 9b60b50973..ab4c244e62 100644
--- a/phpBB/includes/functions_privmsgs.php
+++ b/phpBB/includes/functions_privmsgs.php
@@ -204,7 +204,7 @@ function clean_sentbox($num_sentbox_messages)
 }
 
 // Check Rule against Message Informations
-function check_rule($rules, $rule_row, $message_row, $user_id)
+function check_rule(&$rules, &$rule_row, &$message_row, $user_id)
 {
 	global $user, $config;
 
@@ -249,7 +249,7 @@ function check_rule($rules, $rule_row, $message_row, $user_id)
 }
 
 // Place new messages into appropiate folder
-function place_pm_into_folder($global_privmsgs_rules, $release = false)
+function place_pm_into_folder(&$global_privmsgs_rules, $release = false)
 {
 	global $db, $user, $config;
 
@@ -900,7 +900,7 @@ function rebuild_header($check_ary)
 }
 
 // Print out/Assign recipient informations
-function write_pm_addresses($check_ary, $author, $plaintext = false)
+function write_pm_addresses($check_ary, $author_id, $plaintext = false)
 {
 	global $db, $user, $template, $phpbb_root_path, $SID, $phpEx;
 
@@ -927,7 +927,7 @@ function write_pm_addresses($check_ary, $author, $plaintext = false)
 
 			while ($row = $db->sql_fetchrow($result))
 			{
-				if ($check_type == 'to' || $author == $user->data['user_id'] || $row['user_id'] == $user->data['user_id'])
+				if ($check_type == 'to' || $author_id == $user->data['user_id'] || $row['user_id'] == $user->data['user_id'])
 				{
 					if ($plaintext)
 					{
@@ -953,7 +953,7 @@ function write_pm_addresses($check_ary, $author, $plaintext = false)
 		
 				while ($row = $db->sql_fetchrow($result))
 				{
-					if ($check_type == 'to' || $author == $user->data['user_id'] || $row['user_id'] == $user->data['user_id'])
+					if ($check_type == 'to' || $author_id == $user->data['user_id'] || $row['user_id'] == $user->data['user_id'])
 					{
 						$address[] = $row['group_name'];
 					}
@@ -973,7 +973,7 @@ function write_pm_addresses($check_ary, $author, $plaintext = false)
 				{
 					if (!isset($address['group'][$row['group_id']]))
 					{
-						if ($check_type == 'to' || $author == $user->data['user_id'] || $row['user_id'] == $user->data['user_id'])
+						if ($check_type == 'to' || $author_id == $user->data['user_id'] || $row['user_id'] == $user->data['user_id'])
 						{
 							$address['group'][$row['group_id']] = array('name' => $row['group_name'], 'colour' => $row['group_colour']);
 						}
@@ -1049,7 +1049,7 @@ function get_folder_status($folder_id, $folder)
 //
 
 // Submit PM
-function submit_pm($mode, $subject, $data, $update_message, $put_in_outbox = true)
+function submit_pm($mode, $subject, &$data, $update_message, $put_in_outbox = true)
 {
 	global $db, $auth, $user, $config, $phpEx, $SID, $template;
 
diff --git a/phpBB/includes/functions_profile_fields.php b/phpBB/includes/functions_profile_fields.php
index 41b76f0bba..e10b193f53 100644
--- a/phpBB/includes/functions_profile_fields.php
+++ b/phpBB/includes/functions_profile_fields.php
@@ -11,13 +11,10 @@
 // 
 // -------------------------------------------------------------
 
-// TODO for M-3:
-//
-// * simplify the class (logical seperation between display and insert/update)
-
 class custom_profile
 {
 	var $profile_types = array(1 => 'int', 2 => 'string', 3 => 'text', 4 => 'bool', 5 => 'dropdown', 6 => 'date');
+	var $profile_cache = array();
 	var $options_lang = array();
 
 	// Build language options cache, useful for viewtopic display
@@ -25,7 +22,7 @@ class custom_profile
 	{
 		global $db, $user;
 
-		$this->cache = array();
+		$this->profile_cache = array();
 		
 		$sql = 'SELECT l.*, f.*
 			FROM ' . PROFILE_LANG_TABLE . ' l, ' . PROFILE_FIELDS_TABLE . ' f 
@@ -39,22 +36,57 @@ class custom_profile
 
 		while ($row = $db->sql_fetchrow($result))
 		{
-			$this->cache[$row['field_ident']] = $row;
+			$this->profile_cache[$row['field_ident']] = $row;
 		}
 		$db->sql_freeresult($result);
 	}
 
+	// Get language entries for options and store them here for later use
+	function get_option_lang($field_id, $lang_id, $field_type, $preview)
+	{
+		global $db;
+
+		if ($preview)
+		{
+			$lang_options = (!is_array($this->vars['lang_options'])) ? explode("\n", $this->vars['lang_options']) : $this->vars['lang_options'];
+			
+			foreach ($lang_options as $num => $var)
+			{
+				$this->options_lang[$field_id][$lang_id][($num+1)] = $var;
+			}
+		}
+		else
+		{
+			$sql = 'SELECT option_id, value
+				FROM ' . PROFILE_FIELDS_LANG_TABLE . "
+					WHERE field_id = $field_id
+					AND lang_id = $lang_id
+					AND field_type = $field_type
+				ORDER BY option_id";
+			$result = $db->sql_query($sql);
+
+			while ($row = $db->sql_fetchrow($result))
+			{
+				$this->options_lang[$field_id][$lang_id][$row['option_id']] = $row['value'];
+			}
+			$db->sql_freeresult($result);
+		}
+	}
+
 	// Functions performing operations on register/profile/profile admin
-	function submit_cp_field($mode, &$cp_data, &$cp_error)
+	function submit_cp_field($mode, $lang_id, &$cp_data, &$cp_error)
 	{
-		global $auth, $db;
-
-		$sql = 'SELECT *
-			FROM ' . PROFILE_FIELDS_TABLE . '
-			WHERE field_active = 1
-				' . (($mode == 'register') ? ' AND field_show_on_reg = 1' : '') .
-				(($auth->acl_gets('a_', 'm_') && $mode == 'profile') ? '' : ' AND field_hide = 0') . '
-			ORDER BY field_order';
+		global $auth, $db, $user;
+
+		$sql = 'SELECT l.*, f.*
+			FROM ' . PROFILE_LANG_TABLE . ' l, ' . PROFILE_FIELDS_TABLE . " f 
+			WHERE l.lang_id = $lang_id
+				AND f.field_active = 1
+				" . (($mode == 'register') ? ' AND f.field_show_on_reg = 1' : '') .
+				(($auth->acl_gets('a_', 'm_') && $mode == 'profile') ? '' : ' AND f.field_hide = 0') . '
+				AND l.field_id = f.field_id 
+			GROUP BY f.field_id
+			ORDER BY f.field_order';
 		$result = $db->sql_query($sql);
 					
 		while ($row = $db->sql_fetchrow($result))
@@ -63,16 +95,48 @@ class custom_profile
 
 			if (($cp_result = $this->validate_profile_field($row['field_type'], $cp_data[$row['field_ident']], $row)) !== false)
 			{
-				$cp_error[] = strtoupper($row['field_ident']) . "_$cp_result";
+				// If not and only showing common error messages, use this one
+				$error = '';
+				switch ($cp_result)
+				{
+					case 'FIELD_INVALID_DATE':
+					case 'FIELD_REQUIRED':
+						$error = sprintf($user->lang[$cp_result], $row['lang_name']);
+						break;
+					case 'FIELD_TOO_SHORT':
+					case 'FIELD_TOO_SMALL':
+						$error = sprintf($user->lang[$cp_result], $row['lang_name'], $field_data['field_minlen']);
+						break;
+					case 'FIELD_TOO_LONG':
+					case 'FIELD_TOO_LARGE':
+						$error = sprintf($user->lang[$cp_result], $row['lang_name'], $field_data['field_maxlen']);
+						break;
+					case 'FIELD_INVALID_CHARS':
+						switch ($field_data['field_validation'])
+						{
+							case '[0-9]+':
+								$error = sprintf($user->lang[$cp_result . '_NUMBERS_ONLY'], $row['lang_name']);
+								break;
+							case '[\w]+':
+								$error = sprintf($user->lang[$cp_result . '_ALPHA_ONLY'], $row['lang_name']);
+								break;
+							case '[\w_\+\. \-\[\]]+':
+								$error = sprintf($user->lang[$cp_result . '_SPACERS_ONLY'], $row['lang_name']);
+								break;
+						}
+						break;
+				}
+				$cp_error[] = $error;
 			}
 		}
 		$db->sql_freeresult($result);
 	}
 	
 	// Assign fields to template, mode can be profile (for profile change) or register (for registration)
-	function generate_profile_fields($mode, $lang_id, $cp_error)
+//	function generate_profile_fields($mode, $lang_id, $cp_error)
+	function generate_profile_fields($mode, $lang_id)
 	{
-		global $db, $template, $auth, $user;
+		global $db, $template, $auth;
 
 		$sql = 'SELECT l.*, f.*
 			FROM ' . PROFILE_LANG_TABLE . ' l, ' . PROFILE_FIELDS_TABLE . " f 
@@ -90,8 +154,8 @@ class custom_profile
 			$template->assign_block_vars('profile_fields', array(
 				'LANG_NAME' => $row['lang_name'],
 				'LANG_EXPLAIN' => $row['lang_explain'],
-				'FIELD' => $this->process_field_row('change', $row),
-				'ERROR' => (isset($cp_error[$row['field_ident']])) ? $cp_error[$row['field_ident']] : '')
+				'FIELD' => $this->process_field_row('change', $row))
+//				'ERROR' => $error)
 			);
 		}
 		$db->sql_freeresult($result);
@@ -110,7 +174,7 @@ class custom_profile
 				$user_id = array($user_id);
 			}
 			
-			if (!$this->cache)
+			if (!sizeof($this->profile_cache))
 			{
 				$this->build_cache();
 			}
@@ -138,7 +202,7 @@ class custom_profile
 					if ($ident != 'user_id')
 					{
 						$user_fields[$row['user_id']][$ident]['value'] = $value;
-						$user_fields[$row['user_id']][$ident]['data'] = $this->cache[$ident];
+						$user_fields[$row['user_id']][$ident]['data'] = $this->profile_cache[$ident];
 					}
 				}
 			} 
@@ -155,45 +219,20 @@ class custom_profile
 
 			foreach ($profile_row as $ident => $ident_ary)
 			{
-				$tpl_fields['PF_' . strtoupper($ident) . '_VALUE'] = $this->get_profile_value($ident_ary['data']['field_id'], $ident_ary['data']['lang_id'], $ident_ary['data']['field_type'], $ident_ary['value']);
-				$tpl_fields['PF_' . strtoupper($ident) . '_TITLE'] = $ident_ary['data']['lang_name'];
+				$tpl_fields += array(
+					'PROFILE_' . strtoupper($ident) . '_VALUE'	=> $this->get_profile_value($ident_ary['data']['field_id'], $ident_ary['data']['lang_id'], $ident_ary['data']['field_type'], $ident_ary['value']),
+					'PROFILE_' . strtoupper($ident) . '_TYPE'	=> $ident_ary['data']['field_type'],
+					'PROFILE_' . strtoupper($ident) . '_NAME'	=> $ident_ary['data']['lang_name'],
+					'PROFILE_' . strtoupper($ident) . '_EXPLAIN'=> $ident_ary['data']['lang_explain'],
+
+					'S_PROFILE_' . strtoupper($ident)			=> true
+				);
 			}
 		
 			return $tpl_fields;
 		}
 	}
 
-	// Get language entries for options and store them here for later use
-	function get_option_lang($field_id, $lang_id, $field_type, $preview)
-	{
-		global $db;
-
-		if ($preview)
-		{
-			$lang_options = (!is_array($this->vars['lang_options'])) ? explode("\n", $this->vars['lang_options']) : $this->vars['lang_options'];
-			
-			foreach ($lang_options as $num => $var)
-			{
-				$this->options_lang[$field_id][$lang_id][($num+1)] = $var;
-			}
-		}
-		else
-		{
-			$sql = 'SELECT option_id, value
-				FROM ' . PROFILE_FIELDS_LANG_TABLE . "
-					WHERE field_id = $field_id
-					AND lang_id = $lang_id
-					AND field_type = $field_type
-				ORDER BY option_id";
-			$result = $db->sql_query($sql);
-
-			while ($row = $db->sql_fetchrow($result))
-			{
-				$this->options_lang[$field_id][$lang_id][$row['option_id']] = $row['value'];
-			}
-			$db->sql_freeresult($result);
-		}
-	}
 	
 	// VALIDATE Function - validate entered data
 	function validate_profile_field($field_type, &$field_value, $field_data)
@@ -231,7 +270,7 @@ class custom_profile
 
 				if ($day < 0 || $day > 31 || $month < 0 || $month > 12 || ($year < 1901 && $year > 0) || $year > gmdate('Y', time()))
 				{
-					return 'INVALID_DATE';
+					return 'FIELD_INVALID_DATE';
 				}
 				break;
 
@@ -243,11 +282,11 @@ class custom_profile
 
 				if ($field_value < $field_data['field_minlen'])
 				{
-					return 'TOO_SMALL';
+					return 'FIELD_TOO_SMALL';
 				}
 				else if ($field_value > $field_data['field_maxlen']) 
 				{
-					return 'TOO_LARGE';
+					return 'FIELD_TOO_LARGE';
 				}
 				break;
 		
@@ -264,22 +303,26 @@ class custom_profile
 				{
 					return false;
 				}
+				else if (empty($field_value) && $field_data['field_required'])
+				{
+					return 'FIELD_REQUIRED';
+				}
 
 				if ($field_data['field_minlen'] && strlen($field_value) < $field_data['field_minlen'])
 				{
-					return 'TOO_SHORT';
+					return 'FIELD_TOO_SHORT';
 				}
 				else if ($field_data['field_maxlen'] && strlen($field_value) > $field_data['field_maxlen'])
 				{
-					return 'TOO_LONG';
+					return 'FIELD_TOO_LONG';
 				}
 
-				if (!empty($field_data['field_validation']))
+				if (!empty($field_data['field_validation']) && $field_data['field_validation'] != '.*')
 				{
 					$field_validate = ($field_type == FIELD_STRING) ? $field_value : str_replace("\n", ' ', $field_value);
 					if (!preg_match('#^' . str_replace('\\\\', '\\', $field_data['field_validation']) . '$#i', $field_validate))
 					{
-						return 'INVALID_CHARS';
+						return 'FIELD_INVALID_CHARS';
 					}
 				}
 				break;
@@ -323,7 +366,15 @@ class custom_profile
 
 		$profile_row['field_name'] = (isset($profile_row['var_name'])) ? $profile_row['var_name'] : 'pf_' . $profile_row['field_ident'];
 
-		$value = (isset($_REQUEST[$profile_row['field_name']])) ? request_var($profile_row['field_name'], $default_value) : ((!isset($user->profile_fields[$profile_row['field_ident']]) || $preview) ? $default_value : $user->profile_fields[$profile_row['field_ident']]);
+		// checkbox - only testing for isset
+		if ($profile_row['field_type'] == FIELD_BOOL && $profile_row['field_length'] == 2)
+		{
+			$value = (isset($_REQUEST[$profile_row['field_name']])) ? true : ((!isset($user->profile_fields[$profile_row['field_ident']]) || $preview) ? $default_value : $user->profile_fields[$profile_row['field_ident']]);
+		}
+		else
+		{
+			$value = (isset($_REQUEST[$profile_row['field_name']])) ? request_var($profile_row['field_name'], $default_value) : ((!isset($user->profile_fields[$profile_row['field_ident']]) || $preview) ? $default_value : $user->profile_fields[$profile_row['field_ident']]);
+		}
 
 		switch ($field_validation)
 		{
@@ -395,7 +446,7 @@ class custom_profile
 		}
 		unset($now);
 		
-		$this->set_tpl_vars($profile_row, $value);
+		$this->set_tpl_vars($profile_row, 0);
 		return $this->get_cp_html();
 	}
 
@@ -404,12 +455,12 @@ class custom_profile
 		global $template;
 
 		$value = $this->get_var('int', $profile_row, $profile_row['field_default_value'], $preview);
-		
+
 		$this->set_tpl_vars($profile_row, $value);
 
 		if ($profile_row['field_length'] == 1)
 		{
-			if (!sizeof($this->options_lang[$profile_row['field_id']][$profile_row['lang_id']]))
+			if (!isset($this->options_lang[$profile_row['field_id']][$profile_row['lang_id']]) || !sizeof($this->options_lang[$profile_row['field_id']][$profile_row['lang_id']]))
 			{
 				$this->get_option_lang($profile_row['field_id'], $profile_row['lang_id'], FIELD_BOOL, $preview);
 			}
@@ -668,6 +719,7 @@ class custom_profile_admin extends custom_profile
 
 		$profile_row = array(
 			'var_name'				=> 'field_default_value',
+			'field_id'				=> 1,
 			'lang_name'				=> $this->vars['lang_name'],
 			'lang_explain'			=> $this->vars['lang_explain'],
 			'lang_id'				=> $default_lang_id,
@@ -705,8 +757,10 @@ class custom_profile_admin extends custom_profile
 		);
 
 		$profile_row[1] = $profile_row[0];
-		$profile_row[1]['var_name'] = 'field_no_value';
-		$profile_row[1]['field_ident'] = 'field_no_value';
+		$profile_row[1]['var_name'] = 'field_novalue';
+		$profile_row[1]['field_ident'] = 'field_novalue';
+		$profile_row[1]['field_default_value']	= $this->vars['field_novalue'];
+
 
 		$options = array(
 			0 => array('TITLE' => $user->lang['DEFAULT_VALUE'], 'FIELD' => $this->generate_dropdown($profile_row[0], true)),
diff --git a/phpBB/includes/message_parser.php b/phpBB/includes/message_parser.php
index 88b83e4cd3..6e67e10ac6 100644
--- a/phpBB/includes/message_parser.php
+++ b/phpBB/includes/message_parser.php
@@ -155,6 +155,19 @@ class bbcode_firstpass extends bbcode
 		// when using the /e modifier, preg_replace slashes double-quotes but does not
 		// seem to slash anything else
 		$in = str_replace("\r\n", "\n", str_replace('\"', '"', $in));
+
+		// We remove the hardcoded elements from the code block here because it is not used in code blocks
+		// Having it here saves us one preg_replace per message containing a [code] blocks
+		$htm_match = array(
+			'#<!\-\- e \-\-><a href="mailto:(.*?)">.*?</a><!\-\- e \-\->#',
+			'#<!\-\- m \-\-><a href="(.*?)" target="_blank">.*?</a><!\-\- m \-\->#',
+			'#<!\-\- w \-\-><a href="http:\/\/(.*?)" target="_blank">.*?</a><!\-\- w \-\->#',
+			'#<!\-\- l \-\-><a href="(.*?)" target="_blank">.*?</a><!\-\- l \-\->#',
+			'#<!\-\- s(.*?) \-\-><img src="\{SMILE_PATH\}\/.*? \/><!\-\- s\1 \-\->#',
+			'#<!\-\- h \-\-><(.*?)><!\-\- h \-\->#',
+		);
+		$htm_replace = array('\1', '\1', '\1', '\1', '\1', '&lt;\1&gt;');
+
 		$out = '';
 
 		do
@@ -162,7 +175,7 @@ class bbcode_firstpass extends bbcode
 			$pos = stripos($in, '[/code]') + 7;
 			$code = substr($in, 0, $pos);
 			$in = substr($in, $pos);
-
+			
 			// $code contains everything that was between code tags (including the ending tag) but we're trying to grab as much extra text as possible, as long as it does not contain open [code] tags
 			while ($in)
 			{
@@ -182,6 +195,7 @@ class bbcode_firstpass extends bbcode
 
 			$code = substr($code, 0, -7);
 //			$code = preg_replace('#^[\r\n]*(.*?)[\n\r\s\t]*$#s', '$1', $code);
+			$code = preg_replace($htm_match, $htm_replace, $code);
 
 			switch (strtolower($stx))
 			{
@@ -213,9 +227,9 @@ class bbcode_firstpass extends bbcode
 
 					if ($remove_tags)
 					{
-						$str_from[] = '<span class="syntaxdefault">&lt;?php&nbsp;</span>';
+						$str_from[] = '<span class="syntaxdefault">&lt;?php </span>';
 						$str_to[] = '';
-						$str_from[] = '<span class="syntaxdefault">&lt;?php&nbsp;';
+						$str_from[] = '<span class="syntaxdefault">&lt;?php ';
 						$str_to[] = '<span class="syntaxdefault">';
 					}
 
@@ -240,10 +254,11 @@ class bbcode_firstpass extends bbcode
 					$out .= '[code:' . $this->bbcode_uid . ']' . str_replace($str_from, $str_to, $code) . '[/code:' . $this->bbcode_uid . ']';
 			}
 
-			if (preg_match('#(.*?)\[code(?:=[a-z]+)?\](.+)#is', $in, $m))
+			if (preg_match('#(.*?)\[code(?:=([a-z]+))?\](.+)#is', $in, $m))
 			{
 				$out .= $m[1];
-				$in = $m[2];
+				$stx = $m[2];
+				$in = $m[3];
 			}
 		}
 		while ($in);
@@ -282,10 +297,10 @@ class bbcode_firstpass extends bbcode
 			{
 				// if $tok is ']' the buffer holds a tag
 
-				if ($buffer == '/list' && count($list_end_tags))
+				if ($buffer == '/list' && sizeof($list_end_tags))
 				{
 					// valid [/list] tag
-					if (count($item_end_tags))
+					if (sizeof($item_end_tags))
 					{
 						// current li tag has not been closed
 						$out = preg_replace('/(\n)?\[$/', '[', $out) . array_pop($item_end_tags) . '][';
@@ -310,10 +325,10 @@ class bbcode_firstpass extends bbcode
 				}
 				else
 				{
-					if ($buffer == '*' && count($list_end_tags))
+					if ($buffer == '*' && sizeof($list_end_tags))
 					{
 						// the buffer holds a bullet tag and we have a [list] tag open
-						if (count($item_end_tags) >= count($list_end_tags))
+						if (sizeof($item_end_tags) >= sizeof($list_end_tags))
 						{
 							// current li tag has not been closed
 							if (preg_match('/\n\[$/', $out, $m))
@@ -354,11 +369,11 @@ class bbcode_firstpass extends bbcode
 		while ($in);
 
 		// do we have some tags open? close them now
-		if (count($item_end_tags))
+		if (sizeof($item_end_tags))
 		{
 			$out .= '[' . implode('][', $item_end_tags) . ']';
 		}
-		if (count($list_end_tags))
+		if (sizeof($list_end_tags))
 		{
 			$out .= '[' . implode('][', $list_end_tags) . ']';
 		}
@@ -374,6 +389,9 @@ class bbcode_firstpass extends bbcode
 		$tok = ']';
 		$out = '[';
 
+		// Add newline at the end of each quote block to prevent parsing errors (urls, smilies, etc.)
+		$in = preg_replace('#([^\n])\[\/quote\]#is', "\\1\n[/quote]", $in);
+
 		$in = substr(str_replace('\"', '"', $in), 1);
 		$close_tags = $error_ary = array();
 		$buffer = '';
@@ -396,7 +414,7 @@ class bbcode_firstpass extends bbcode
 
 			if ($tok == ']')
 			{
-				if ($buffer == '/quote' && count($close_tags))
+				if ($buffer == '/quote' && sizeof($close_tags))
 				{
 					// we have found a closing tag
 
@@ -407,7 +425,7 @@ class bbcode_firstpass extends bbcode
 				elseif (preg_match('#^quote(?:=&quot;(.*?)&quot;)?$#is', $buffer, $m))
 				{
 					// the buffer holds a valid opening tag
-					if ($config['max_quote_depth'] && count($close_tags) >= $config['max_quote_depth'])
+					if ($config['max_quote_depth'] && sizeof($close_tags) >= $config['max_quote_depth'])
 					{
 						// there are too many nested quotes
 						$error_ary['quote_depth'] = sprintf($user->lang['QUOTE_DEPTH_EXCEEDED'], $config['max_quote_depth']);
@@ -483,7 +501,7 @@ class bbcode_firstpass extends bbcode
 		}
 		while ($in);
 
-		if (count($close_tags))
+		if (sizeof($close_tags))
 		{
 			$out .= '[' . implode('][', $close_tags) . ']';
 		}
@@ -626,6 +644,18 @@ class parse_message extends bbcode_firstpass
 			$this->html($config['allow_html_tags']);
 		}
 
+		// Parse Emoticons
+		if ($allow_smilies)
+		{
+			$this->emoticons($config['max_post_smilies']);
+		}
+
+		// Parse URL's
+		if ($allow_magic_url)
+		{
+			$this->magic_url((($config['cookie_secure']) ? 'https://' : 'http://'), $config['server_name'], $config['server_port'], $config['script_path']);
+		}
+
 		// Parse BBCode
 		if ($allow_bbcode && strpos($this->message, '[') !== false)
 		{
@@ -641,18 +671,6 @@ class parse_message extends bbcode_firstpass
 			$this->parse_bbcode();
 		}
 
-		// Parse Emoticons
-		if ($allow_smilies)
-		{
-			$this->emoticons($config['max_post_smilies']);
-		}
-
-		// Parse URL's
-		if ($allow_magic_url)
-		{
-			$this->magic_url((($config['cookie_secure']) ? 'https://' : 'http://'), $config['server_name'], $config['server_port'], $config['script_path']);
-		}
-
 		if (!$update_this_message)
 		{
 			unset($this->message);
@@ -737,7 +755,7 @@ class parse_message extends bbcode_firstpass
 			
 		if (sizeof($allowed_tags))
 		{
-			$this->message = preg_replace('#&lt;(\/?)(' . str_replace('*', '.*?', implode('|', $allowed_tags)) . ')&gt;#is', '<$1$2>', $this->message);
+			$this->message = preg_replace('#&lt;(\/?)(' . str_replace('*', '.*?', implode('|', $allowed_tags)) . ')&gt;#is', '<!-- h --><$1$2><!-- h -->', $this->message);
 		}
 	}
 
@@ -786,9 +804,24 @@ class parse_message extends bbcode_firstpass
 		global $db, $user, $phpbb_root_path;
 
 		// NOTE: obtain_* function? chaching the table contents?
+
 		// For now setting the ttl to 10 minutes
-		$sql = 'SELECT * 
-			FROM ' . SMILIES_TABLE;
+		switch (SQL_LAYER)
+		{
+			case 'mssql':
+			case 'mssql-odbc':
+				$sql = 'SELECT * 
+					FROM ' . SMILIES_TABLE . '
+					ORDER BY LEN(code) DESC';
+				break;
+
+			// LENGTH supported by MySQL, IBM DB2, Oracle and Access for sure...
+			default:
+				$sql = 'SELECT * 
+					FROM ' . SMILIES_TABLE . '
+					ORDER BY LENGTH(code) DESC';
+				break;
+		}
 		$result = $db->sql_query($sql, 600);
 
 		if ($row = $db->sql_fetchrow($result))
@@ -884,7 +917,7 @@ class parse_message extends bbcode_firstpass
 			}
 		}
 
-		if ($preview || $refresh || count($error))
+		if ($preview || $refresh || sizeof($error))
 		{
 			// Perform actions on temporary attachments
 			if ($delete_file)
@@ -932,7 +965,7 @@ class parse_message extends bbcode_firstpass
 
 						$error = array_merge($error, $filedata['error']);
 
-						if (!count($error))
+						if (!sizeof($error))
 						{
 							$new_entry = array(
 								'physical_filename'	=> $filedata['destination_filename'],
diff --git a/phpBB/includes/session.php b/phpBB/includes/session.php
index c69328ff5a..add209bd83 100644
--- a/phpBB/includes/session.php
+++ b/phpBB/includes/session.php
@@ -132,7 +132,7 @@ class session
 
 		$sessiondata = array();
 		$current_time = time();
-		$current_user = $this->data['user_id'];
+		$current_user = $user_id;
 		$bot = false;
 
 		// Pull bot information from DB and loop through it
@@ -568,9 +568,6 @@ class user extends session
 		unset($row);
 		unset($row2);
 
-		// Set theme info
-		$theme_info = array();
-
 		// Add to template database
 		foreach (array_keys($this->theme) as $style_priority)
 		{
@@ -1000,7 +997,7 @@ class auth
 		{
 			foreach ($this->acl_options['global'] as $opt => $id)
 			{
-				if (strstr($opt, 'a_'))
+				if (strpos($opt, 'a_') !== false)
 				{
 					$hold_ary[0][$opt] = 1;
 				}
diff --git a/phpBB/includes/template.php b/phpBB/includes/template.php
index 60cab6bd6c..71ab2bbc45 100644
--- a/phpBB/includes/template.php
+++ b/phpBB/includes/template.php
@@ -350,7 +350,7 @@ class template
 		}
 		$compile_blocks = array();
 
-		for ($curr_tb = 0; $curr_tb < count($text_blocks); $curr_tb++)
+		for ($curr_tb = 0, $tb_size = sizeof($text_blocks); $curr_tb < $tb_size; $curr_tb++)
 		{
 			switch ($blocks[1][$curr_tb])
 			{
@@ -427,7 +427,7 @@ class template
 		}
 
 		$template_php = '';
-		for ($i = 0; $i < count($text_blocks); $i++)
+		for ($i = 0, $size = sizeof($text_blocks); $i < $size; $i++)
 		{
 			$trim_check_text = trim($text_blocks[$i]);
 			$trim_check_block = trim($compile_blocks[$i]);
@@ -450,7 +450,7 @@ class template
 		// This one will handle varrefs WITH namespaces
 		preg_match_all('#\{(([a-z0-9\-_]+?\.)+?)(\$)?([A-Z0-9\-_]+?)\}#', $text_blocks, $varrefs);
 
-		for ($j = 0; $j < sizeof($varrefs[1]); $j++)
+		for ($j = 0, $size = sizeof($varrefs[1]); $j < $size; $j++)
 		{
 			$namespace = $varrefs[1][$j];
 			$varname = $varrefs[4][$j];
@@ -541,7 +541,7 @@ class template
         $tokens = $match[0];
         $is_arg_stack = array();
 
-        for ($i = 0; $i < count($tokens); $i++)
+        for ($i = 0, $size = sizeof($tokens); $i < $size; $i++)
 		{
 			$token = &$tokens[$i];
 
diff --git a/phpBB/includes/ucp/ucp_pm_viewfolder.php b/phpBB/includes/ucp/ucp_pm_viewfolder.php
index 990bcc09d5..d0bf1384ba 100644
--- a/phpBB/includes/ucp/ucp_pm_viewfolder.php
+++ b/phpBB/includes/ucp/ucp_pm_viewfolder.php
@@ -71,7 +71,6 @@ function view_folder($id, $mode, $folder_id, $folder, $type)
 		$recipient_list = $address_list = $address = array();
 		if ($folder_id == PRIVMSGS_OUTBOX || $folder_id == PRIVMSGS_SENTBOX)
 		{
-			
 			foreach ($folder_info['rowset'] as $message_id => $row)
 			{
 				$address[$message_id] = rebuild_header(array('to' => $row['to_address'], 'bcc' => $row['bcc_address']));
@@ -122,8 +121,8 @@ function view_folder($id, $mode, $folder_id, $folder, $type)
 
 		foreach ($folder_info['pm_list'] as $message_id)
 		{
-			$row =& $folder_info['rowset'][$message_id];
-
+			$row = &$folder_info['rowset'][$message_id];
+			
 			$folder_img = ($row['unread']) ? 'folder_new' : 'folder';
 			$folder_alt = ($row['unread']) ? 'NEW_MESSAGES' : 'NO_NEW_MESSAGES';
 
@@ -167,8 +166,8 @@ function view_folder($id, $mode, $folder_id, $folder, $type)
 //				'U_MCP_QUEUE'		=> "mcp.$phpEx?sid={$user->session_id}&amp;mode=mod_queue&amp;t=$topic_id")
 			);
 
-			unset($folder_info['rowset'][$message_id]);
 		}
+		unset($folder_info['rowset']);
 	
 		$template->assign_vars(array(
 			'S_SHOW_RECIPIENTS'	=> ($folder_id == PRIVMSGS_OUTBOX || $folder_id == PRIVMSGS_SENTBOX) ? true : false,
diff --git a/phpBB/includes/ucp/ucp_profile.php b/phpBB/includes/ucp/ucp_profile.php
index e89ce7947f..f4e963daae 100644
--- a/phpBB/includes/ucp/ucp_profile.php
+++ b/phpBB/includes/ucp/ucp_profile.php
@@ -252,9 +252,14 @@ class ucp_profile extends module
 					unset($data);
 
 					// validate custom profile fields
-					$cp->submit_cp_field('profile', $cp_data, $cp_error);
+					$cp->submit_cp_field('profile', $user->get_iso_lang_id(), $cp_data, $cp_error);
 
-					if (!sizeof($error) && !sizeof($cp_error))
+					if (sizeof($cp_error))
+					{
+						$error = array_merge($error, $cp_error);
+					}
+
+					if (!sizeof($error))
 					{
 						$sql_ary = array(
 							'user_icq'		=> $icq,
@@ -351,7 +356,7 @@ class ucp_profile extends module
 				// Get additional profile fields and assign them to the template block var 'profile_fields'
 				$user->get_profile_fields($user->data['user_id']);
 
-				$cp->generate_profile_fields('profile', $user->get_iso_lang_id(), $cp_error);
+				$cp->generate_profile_fields('profile', $user->get_iso_lang_id());
 
 				break;
 
diff --git a/phpBB/includes/ucp/ucp_register.php b/phpBB/includes/ucp/ucp_register.php
index a6a55df546..cd188cd383 100644
--- a/phpBB/includes/ucp/ucp_register.php
+++ b/phpBB/includes/ucp/ucp_register.php
@@ -111,7 +111,7 @@ class ucp_register extends module
 			$error = preg_replace('#^([A-Z_]+)$#e', "(!empty(\$user->lang['\\1'])) ? \$user->lang['\\1'] : '\\1'", $error);
 
 			// validate custom profile fields
-			$cp->submit_cp_field('register', $cp_data, $error);
+			$cp->submit_cp_field('register', $user->get_iso_lang_id(), $cp_data, $error);
 
 			// Visual Confirmation handling
 			$wrong_confirm = false;
@@ -438,7 +438,7 @@ class ucp_register extends module
 		$user->profile_fields = array();
 
 		// Generate profile fields -> Template Block Variable profile_fields
-		$cp->generate_profile_fields('register', $user->get_iso_lang_id(), $cp_error);
+		$cp->generate_profile_fields('register', $user->get_iso_lang_id());
 
 		//
 		$this->display($user->lang['REGISTER'], 'ucp_register.html');