diff --git a/app/logical/d_text.rb b/app/logical/d_text.rb
index de90e2ebd..cd7524e57 100644
--- a/app/logical/d_text.rb
+++ b/app/logical/d_text.rb
@@ -11,15 +11,30 @@ class DText
   end
   
   def self.parse_inline(str, options = {})
+    str.gsub!(/&/, "&")
+    str.gsub!(/</, "&lt;")
+    str.gsub!(/>/, "&gt;")
     str.gsub!(/\n/m, "<br>")
     str.gsub!(/\[b\](.+?)\[\/b\]/i, '<strong>\1</strong>')
     str.gsub!(/\[i\](.+?)\[\/i\]/i, '<em>\1</em>')
-    str.gsub!(/\[spoilers?\](.+?)\[\/spoilers?\]/m, '<span class="spoiler">\1</span>')
-    str.gsub!(/\[url\](.+?)\[\/url\]/i) do
-      %{<a href="#{u($1)}">#{h($1)}</a>}
+    str.gsub!(/(?<![=\]])(https?:\/\/\S+)/m) do |link|
+      if link =~ /([;,.!?\)\]])$/
+        stop = $1
+        link.chop!
+        text = link
+      else
+        stop = ""
+        text = link
+      end
+
+      link.gsub!(/"/, '&quot;')
+      '<a href="' + link + '">' + text + '</a>' + stop
     end
-    str.gsub!(/\[url=(.+?)\](.+?)\[\/url\]/m) do
-      %{<a href="#{u($1)}">#{h($2)}</a>}
+    str.gsub!(/\[url\](http.+?)\[\/url\]/i) do
+      %{<a href="#{$1}">#{$1}</a>}
+    end
+    str.gsub!(/\[url=(http.+?)\](.+?)\[\/url\]/m) do
+      %{<a href="#{$1}">#{$2}</a>}
     end
     str = parse_aliased_wiki_links(str)
     str = parse_wiki_links(str)
@@ -30,33 +45,36 @@ class DText
   
   def self.parse_aliased_wiki_links(str)
     str.gsub(/\[\[(.+?)\|(.+?)\]\]/m) do
-      text = $1
-      title = $2
+      text = CGI.unescapeHTML($1)
+      title = CGI.unescapeHTML($2)
       wiki_page = WikiPage.find_title_and_id(title)
       
       if wiki_page
-        %{<a href="/wiki_pages/#{wiki_page.id}">#{text}</a>}
+        %{<a href="/wiki_pages/#{wiki_page.id}">#{h(text)}</a>}
       else
-        %{<a href="/wiki_pages/new?title=#{title}">#{text}</url>}
+        %{<a href="/wiki_pages/new?title=#{u(title)}">#{h(text)}</url>}
       end
     end
   end
   
   def self.parse_wiki_links(str)
     str.gsub(/\[\[(.+?)\]\]/) do
-      title = $1
+      title = CGI.unescapeHTML($1)
       wiki_page = WikiPage.find_title_and_id(title)
       
       if wiki_page
-        %{<a href="/wiki_pages/#{wiki_page.id}">#{title}</a>}
+        %{<a href="/wiki_pages/#{wiki_page.id}">#{h(title)}</a>}
       else
-        %{<a href="/wiki_pages/new?wiki_page[title]=#{title}">#{title}</a>}
+        %{<a href="/wiki_pages/new?wiki_page[title]=#{u(title)}">#{h(title)}</a>}
       end
     end
   end
   
   def self.parse_post_links(str)
-    str.gsub(/\{\{(.+?)\}\}/, %{<a href="/posts?tags=\\1">\\1</a>})
+    str.gsub(/\{\{(.+?)\}\}/) do
+      tags = CGI.unescapeHTML($1)
+      %{<a href="/posts?tags=#{u(tags)}">#{h(tags)}</a>}
+    end
   end
   
   def self.parse_id_links(str)
@@ -110,11 +128,14 @@ class DText
     unless options[:inline]
       str.gsub!(/\s*\[quote\]\s*/m, "\n\n[quote]\n\n")
       str.gsub!(/\s*\[\/quote\]\s*/m, "\n\n[/quote]\n\n")
+      str.gsub!(/\s*\[spoilers?\](?!\])\s*/m, "\n\n[spoiler]\n\n")
+      str.gsub!(/\s*\[\/spoilers?\]\s*/m, "\n\n[/spoiler]\n\n")
     end
     
     str.gsub!(/(?:\r?\n){3,}/, "\n\n")
     str.strip!
     blocks = str.split(/(?:\r?\n){2}/)
+    stack = []
     
     html = blocks.map do |block|
       case block
@@ -135,22 +156,57 @@ class DText
         if options[:inline]
           ""
         else
-          '<blockquote>'
+          stack << "blockquote"
+          "<blockquote>"
         end
         
       when "[/quote]"
         if options[:inline]
           ""
-        else
+        elsif stack.last == "blockquote"
+          stack.pop
           '</blockquote>'
+        else
+          ""
+        end
+
+      when /\[spoilers?\](?!\])/
+        stack << "div"
+        '<div class="spoiler">'
+        
+      when /\[\/spoilers?\]/
+        if stack.last == "div"
+          stack.pop
+          '</div>'
         end
 
       else
         '<p>' + parse_inline(block) + "</p>"
       end
     end
+    
+    stack.reverse.each do |tag|
+      if tag == "blockquote"
+        html << "</blockquote>"
+      elsif tag == "div"
+        html << "</div>"
+      end
+    end
 
-    Sanitize.clean(html.join(""), Sanitize::Config::BASIC).html_safe
+    Sanitize.clean(
+      html.join(""),
+      :elements => %w(h1 h2 h3 h4 h5 h6 a span div blockquote br p ul li ol em strong),
+      :attributes => {
+        "a" => %w(href title),
+        "span" => %w(class),
+        "div" => %w(class)
+      },
+      :protocols => {
+        "a" => {
+          "href" => ["http", "https", :relative]
+        }
+      }
+    ).html_safe
   end
 end
 
diff --git a/test/unit/dtext_test.rb b/test/unit/dtext_test.rb
new file mode 100644
index 000000000..c9a0a0d9b
--- /dev/null
+++ b/test/unit/dtext_test.rb
@@ -0,0 +1,81 @@
+require "test_helper"
+
+class DTextTest < ActiveSupport::TestCase
+  def p(s)
+    DText.parse(s)
+  end
+  
+  def test_sanitize
+    assert_equal('<p>&lt;</p>', p("<"))
+    assert_equal('<p>&gt;</p>', p(">"))
+    assert_equal('<p>&amp;</p>', p("&"))
+  end
+  
+  def test_wiki_links
+    assert_equal("<p>a <a href=\"/wiki_pages/new?wiki_page%5Btitle%5D=b\">b</a> c</p>", p("a [[b]] c"))
+    assert_equal("<p>a <a href=\"/wiki_pages/new?wiki_page%5Btitle%5D=spoiler\">spoiler</a> c</p>", p("a [[spoiler]] c"))
+  end
+  
+  def test_spoilers
+    assert_equal("<p>this is</p><div class=\"spoiler\"><p>an inline spoiler</p></div><p>.</p>", p("this is [spoiler]an inline spoiler[/spoiler]."))
+    assert_equal("<p>this is</p><div class=\"spoiler\"><p>a block spoiler</p></div><p>.</p>", p("this is\n\n[spoiler]\na block spoiler\n[/spoiler]."))
+  end
+  
+  def test_paragraphs
+    assert_equal("<p>a</p>", p("a"))
+    assert_equal("<p>abc</p>", p("abc"))
+    assert_equal("<p>a<br>b<br>c</p>", p("a\nb\nc"))
+    assert_equal("<p>a</p><p>b</p>", p("a\n\nb"))
+  end
+  
+  def test_headers
+    assert_equal("<h1>header</h1>", p("h1. header"))
+    assert_equal("<h1>header</h1><p>paragraph</p>", p("h1.header\n\nparagraph"))
+  end
+  
+  def test_quote_blocks
+    assert_equal('<blockquote><p>test</p></blockquote>', p("[quote]\ntest\n[/quote]"))
+    assert_equal("<blockquote>\n<p>a</p>\n<blockquote><p>b</p></blockquote>\n<p>c</p>\n</blockquote>", p("[quote]\na\n[quote]\nb\n[/quote]\nc\n[/quote]"))
+  end
+  
+  def test_urls
+    assert_equal('<p>a <a href="http://test.com">http://test.com</a> b</p>', p('a http://test.com b'))
+    assert_equal('<p>a <a href="http://test.com/~bob/image.jpg">http://test.com/~bob/image.jpg</a> b</p>', p('a http://test.com/~bob/image.jpg b'))
+    assert_equal('<p>a <a href="http://test.com/home.html#toc">http://test.com/home.html#toc</a> b</p>', p('a http://test.com/home.html#toc b'))
+    assert_equal('<p>a <a href="http://test.com">http://test.com</a>. b</p>', p('a http://test.com. b'))
+    assert_equal('<p>a (<a href="http://test.com">http://test.com</a>) b</p>', p('a (http://test.com) b'))
+  end
+  
+  def test_links
+    assert_equal('<p><a href="http://test.com">test</a></p>', p('[url=http://test.com]test[/url]'))
+    assert_equal('<p>"1" <a href="http://two.com">2</a></p>', p('"1" [url=http://two.com]2[/url]'))
+    assert_equal('<p>"1" <a href="http://three.com">2 &amp; 3</a></p>', p('"1" [url=http://three.com]2 & 3[/url]'))
+  end
+  
+  def test_aliased_urls
+    assert_equal('<p>a <a href="http://test.com">bob</a>. b</p>', p('a [url=http://test.com]bob[/url]. b'))
+    assert_equal('<p><em><a href="http://test.com">bob</a></em></p>', p('[i][url=http://test.com]bob[/url][/i]'))
+  end
+  
+  def test_lists
+    assert_equal('<ul><li>a</li></ul>', p('* a'))
+    assert_equal('<ul><li>a</li><li>b</li></ul>', p("* a\n* b").gsub(/\n/, ""))
+    assert_equal('<ul><li>a</li><ul><li>b</li></ul></ul>', p("* a\n** b").gsub(/\n/, ""))
+    assert_equal('<ul><li><a href="/posts/1">post #1</a></li></ul>', p("* post #1").gsub(/\n/, ""))
+  end
+  
+  def test_inline
+    assert_equal('<p><a href="/posts?tags=tag">tag</a></p>', p("{{tag}}"))
+    assert_equal('<p><a href="/posts?tags=tag1+tag2">tag1 tag2</a></p>', p("{{tag1 tag2}}"))
+    assert_equal('<p><a href="/posts?tags=%3C3">&lt;3</a></p>', p("{{<3}}"))
+  end
+  
+  def test_missing_spoiler_tags
+    assert_equal('<div class="spoiler"><p>testing</p></div>', p('[spoiler]testing'))
+    assert_equal('<div class="spoiler"><div class="spoiler"><p>testing</p></div></div>', p('[spoiler][spoiler]testing[/spoiler]'))
+  end
+  
+  def test_extra_newlines
+    assert_equal('<p>a</p><p>b</p>', p("a\n\n\n\n\n\n\nb\n\n\n\n"))
+  end
+end