CB

Added new function to evaluate [FIELD] instead of simply looping through user object and replacing. New function checks to make sure the contents inside of [] is actually a field before returning the resulting value (stops [asdgag] from returning nothing for instance).

r1525 implements slightly differently the raw DATA but same principle and result.

For userfield the patch has 2 issues:

1. it is not case-insensitive like the replaced old code, so [USERNAME] wouldn't work as it did.
2. Additionally it doesn't handle $htmlspecialchar parameter properly, and as such would be a vulnerability if implemented that way.

Thus patch can't be applied to CB as is.

Preparing an alternate, secure, implementation solving the 2 issues detected above.

r1528 implements this