BBCode to HTML

What this tool is used for

• Migrating forum posts from a BBCode-based platform to one that stores HTML.
• Rendering a legacy post archive for a static site.
• Checking how a BBCode snippet will look once converted.
• Converting a signature or a template from an old forum.
• Producing HTML from user content that was authored in BBCode.

Frequently Asked Questions

What is BBCode and why does it exist?

A markup language using square brackets — [b]bold[/b] — invented for bulletin boards so users could format posts without being allowed raw HTML. Restricting the tag set is precisely the point: it prevents XSS by construction.

Is BBCode standardised?

No, and that is its main practical problem. phpBB, vBulletin, XenForo and SMF each support different tags and attributes, so [size] may take a number, a percentage or a keyword depending on the forum.

Is converting BBCode to HTML safe?

Only if the output is escaped. A converter that passes through unrecognised input can emit raw HTML from a crafted post, reintroducing the XSS that BBCode existed to prevent. Escape first, then substitute known tags.

How are nested and unclosed tags handled?

Badly, in most naive converters. [b][i]text[/b][/i] is improperly nested and produces invalid HTML if translated literally; a correct converter tracks a tag stack and closes in the right order.

Is BBCode still used?

Yes, on long-running forums and in some game communities, though Markdown has largely displaced it for new projects. Conversion is usually needed when migrating an old forum's archive to a modern platform.

How should unknown tags be handled?

Left as literal text rather than stripped, since BBCode has no registry and a forum's custom tag is indistinguishable from a typo. Stripping silently loses content the author meant to keep.

Why is `[url]` the dangerous tag?

Because it produces an `href`, and an unvalidated value can carry `javascript:` or `data:` — turning a formatting language into script injection. The scheme has to be allow-listed, not merely escaped.

Can HTML be converted back to BBCode?

Only approximately. HTML expresses far more than BBCode's tag set, so anything without an equivalent is dropped or flattened — the conversion is lossy in that direction and not in this one.

Common errors and gotchas

• Trusting the output as safe HTML. Converted user content still needs sanitising before it is rendered.
• Assuming one BBCode dialect, since tag sets and attribute syntax vary by forum software.
• Losing an unclosed tag's intent, which BBCode parsers handle differently from one another.
• Converting a nested quote or list incorrectly, where depth handling is the usual weak point.
• Expecting custom tags from a specific forum to be recognised by a general converter.