WordPress MU

i've been trying to knock out a whitelist style widget so that users could use those csocial sites with getting us hacked... again. thought i found a shortcut and took the MyBlogLog plugin and modded it with Blogcatalog. all thats been changed is any information referencing bloglog. but the js is getting eatin. not sure why. looking at the code below, can anyone see why it might work for one site but not for the other/

'// This gets called at the plugins_loaded action
function widget_blogcatalog_init() {

// Check for the required API functions
if ( !function_exists('register_sidebar_widget') || !function_exists('register_widget_control') )
return;

// This saves options and prints the widget's config form.
function widget_blogcatalog_control() {
$options = $newoptions = get_option('widget_blogcatalog');
if ( $_POST['blogcatalog-submit'] ) {
$valid_code = trim(stripslashes($_POST['blogcatalog-code']));

// Making sure it's a blogcatalog widget
$n_m = preg_match('/^<(script|iframe|object|a)(.+)(src|value|href)(.+)(blogcatalog\.com\/)(.+)mblID=([0-9]+)(.+)<\/(script|iframe|object|a)>$/im', $valid_code);
if($n_m == 0) {
$valid_code = '';
}
$newoptions['blogcatalog_code'] = $valid_code;
}
if ( $options != $newoptions ) {
$options = $newoptions;
update_option('widget_blogcatalog', $options);
}
?>
<div>
<p style="text-align:left">blogcatalog is how you get to know who reads your blog and why. Just install this widget. You'll get both a public photo lineup of who's been reading your blog recently and a private reporting page of what your readers read and clicked on.</p>
<p style="text-align:left">To make it work, you must go and get one of blogcatalog widget codes and then paste it below.</p>
<textarea id="blogcatalog-code" name="blogcatalog-code" style="width:370px;height:110px;padding:0px;margin:0px;"><?php echo wp_specialchars($options['blogcatalog_code'], true); ?></textarea>
<input type="hidden" name="blogcatalog-submit" id="blogcatalog-submit" value="1" />
</div>
<?php
}

// This prints the widget
function widget_blogcatalog($args) {
extract($args);
$defaults = array();
$options = (array) get_option('widget_blogcatalog');

foreach ( $defaults as $key => $value )
if ( !isset($options[$key]) )
$options[$key] = $defaults[$key];

?>
<?php echo $before_widget; ?>
<?php echo $before_title . "" . $after_title; ?>
<?php echo $options['blogcatalog_code']; ?>
<?php echo $after_widget; ?>
<?php
}

// Tell Dynamic Sidebar about our new widget and its control
register_sidebar_widget('blogcatalog', 'widget_blogcatalog');
register_widget_control('blogcatalog', 'widget_blogcatalog_control', 370, 300);

}

// Delay plugin execution to ensure Dynamic Sidebar has a chance to load first
add_action('widgets_init', 'widget_blogcatalog_init');

?>'

Here's a "thought". It may/may not help/be relevant.

How is the text/script formatted so that the user can insert it?

Is there something that is common to all those scripts?

Let's say the scripts look like this:

<script type="text/javascript" src="http://link-to-site.tld/path/to/script"></script>

That being said, let's say that the common part of any insertion is up to the tld/ part. Then the path is different, and the closing script is of course common.

You could hardcode the common parts in the widget to output before and after the part which a user could enter.

So essentially, the user is only entering in the path section, and the widget then outputs the before and after.

Same could apply for an embed for flash, or what ever. Just have to figure out a way to do it.

Maybe on input, before it hits the db, you could replace all the <'s / >'s with [brackets] instead, and then when rendering it on the output side, do the opposite.

you can get a beta blogcatalog sidbar widget at http://www.blogcatalog.com/discuss/entry/beta-blogcatalog-wordpress-sidebar-widget

are you talking about myblog joomla compnent?