xss vulnerabilities in php code

[isaacsu]

$_GET variables coming through need to be escaped, but it needs to be in the context of a slightly broader design discussion. (i.e. what characters are allowed for room names, usernames, etc.)

[igorw]

$_SERVER should also be escaped in most cases.