Splatt Forum html injection code in post icon

Any user can inject html code when create a new post. The bug are in the post icon: img src="icon.gif" etc. If you create a personalized form with this code: icon.gif"scriptalert'bug';scriptany tag=" the final code of the post icon is: img src="icon.gif"scriptalert'bug';scriptany tag="" etc. The...