I've got a user on my forum who has found a XSS injection spot somewhere on my site. He has hijacked the admins accounts many times and refuses to share the exploit? Has anyone had this happen? Does anyone know where he would be injecting? If I find, I'll share here.

I'm not trying to display their name in the online list, I have chat commands and I was going to make a command like !viewer. So it would be used like: Hello, !viewer.
!viewer would be replace with the username of the viewer.

That does not work in a chat, it only displays the shouter's username to everyone.

I was thinking in a BBCode but it doesn't have to be that. I'm trying to display the viewers username in Handyman's AJAX Chat. We have custom chat commands that can parse php so it could easily be any type of php code.

Is there any way to do this on phpbb 3? I saw a link on google for a old mod here for the same thing. URL was broken and I couldn't find the topic. Any help?