a hidden script in image tags
 

We have a well meaning ( or so he says) member at our forum that "hacked" the site to show it had security flaws.

Here's how he/she did it http://kickenhardware.t35.com/pd4ps/how%20it%20is.htm.

He/she hid the script in an img tag sent in a pm. So how can I stop this from happening again?

I don't want to disable the img tag altogether because we are on a shared server and storage of attachements could be a problem.

So what should I do? I am using vb 3.7.4

If this post is not in the right spot, or has been answered elsewhere, I do apologize. I have ran a search on this forum and can't find a solution other than to disallow dynamic images, but I can't find a setting in version 3.7.4 to do that.

Any help would be appreciated.