change bbcode parse order + code tag sanitising

app/BBCode/Parser.php

@@ -21,6 +21,23 @@ class Parser
      * @var array
      */
     public static $parsers = [
+        // Advanced parsing
+        Tags\Code::class,
+        Tags\Box::class,
+        Tags\ListTag::class,
+        Tags\UserTag::class,
+        Tags\Markdown::class,
+
+        // Quotes
+        Tags\NamedQuote::class,
+        Tags\Quote::class,
+
+        // More advanced
+        Tags\Colour::class,
+        Tags\Align::class,
+        Tags\Size::class,
+        Tags\YouTube::class,
+
         // Basic markup
         Tags\Bold::class,
         Tags\Italics::class,
@@ -30,27 +47,10 @@ class Parser
         Tags\Image::class,
         Tags\Spoiler::class,
 
-        // More advanced
-        Tags\Colour::class,
-        Tags\Align::class,
-        Tags\Size::class,
-        Tags\YouTube::class,
-
         // Links
         Tags\NamedLink::class,
         Tags\Link::class,
 
-        // Quotes
-        Tags\NamedQuote::class,
-        Tags\Quote::class,
-
-        // Advanced parsing
-        Tags\Box::class,
-        Tags\Code::class,
-        Tags\ListTag::class,
-        Tags\UserTag::class,
-        Tags\Markdown::class,
-
         // Newline must always be last
         Tags\Newline::class,
     ];

app/BBCode/Tags/Code.php

@@ -28,9 +28,9 @@ class Code extends TagBase
             '/\[code(?:\=([a-z]+))?\](.*?)\[\/code\]/s',
             function ($matches) {
                 $class = strlen($matches[1]) ? "lang-{$matches[1]}" : '';
-                // htmlencode bbcode characters here as well
+                $text = str_replace(['[', ']'], ['[', ']'], $matches[2]);
 
-                return "<pre class='bbcode__code'><code class='bbcode__code-container {$class}'>{$matches[2]}</code></pre>";
+                return "<pre class='bbcode__code'><code class='bbcode__code-container {$class}'>{$text}</code></pre>";
             },
             $text
         );