Here's how I make my own "bbcode" and use it.
1) Run htmlentities() on the message being posted to make it safe before it's added to a database.
2) Insert this message that has been altered with htmlentities() into the database.
3) When you are outputting the messages to the page, that's when you want to run something to replace the bbcode with html, this way, if you ever want to alter what a specific tag does, you won't have to go through every post and change the html there, since it'll just have the bbcode in there.
Just use a preg_replace to replace the bbcode with html during output, it's pretty simple:
__________________________________________________
$pattern=array(
'/\[b\](.*)\[\/b\]/i',
'/\[i\](.*)\[\/i\]/i',
'/\[u\](.*)\[\/u\]/i',
'/\[color=(.*)\](.*)\[\/color\]/i'
);
$replace=array(
'<b>\\1</b>',
'<i>\\1</i>',
'<u>\\1</u>',
'<font color=\"\\1\">\\2</font>'
);
preg_replace($pattern,$replace,$stringToOutput);
__________________________________________________
$stringToOutput would be the string that is being outputted from the database.
Example snippet:
while($row = mysql_fetch_array($result)){
echo preg_replace($pattern,$replace,stripslashes($row['message'])).'<br /><br />;
}