and I found the [img] tag is less secure then the [url], on default settings.

this will be fixed in the next version. although I'm glad that it seems at least the newest browsers don't execute javascript in img tags.