    public static function BBCode2Html($text) {
        $text = trim($text);

        $text = self::parseEmoji($text);

        // Smileys to find...
        $in = array(
        );

        // And replace them by...
        $out = array(
        );

        $in[] = '[/*]';
        $in[] = '[*]';
        $out[] = '</li>';
        $out[] = '<li>';

        $text = str_replace($in, $out, $text);

        // BBCode to find...
        $in = array( 	 '/\[b\](.*?)\[\/b\]/ms',
            '/\[i\](.*?)\[\/i\]/ms',
            '/\[u\](.*?)\[\/u\]/ms',
            '/\[mark\](.*?)\[\/mark\]/ms',
            '/\[s\](.*?)\[\/s\]/ms',
            '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
            '/\[list\](.*?)\[\/list\]/ms',
            '/\[\*\]\s?(.*?)\n/ms',
            '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
            '/\[color\=(.*?)\](.*?)\[\/color\]/ms'
        );

        // And replace them by...
        $out = array(	 '\1',
            '\1',
            '\1',
            '\1',
            '\1',
            '\2',
            '\1',
            '\1',
            '\2',
            '\2'
        );

        $text = preg_replace($in, $out, $text);

        // Prepare quote's
        $text = str_replace("\r\n","\n",$text);

        // paragraphs
        $text = str_replace("\r", "", $text);

        return $text;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.