Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

These emotions where taken from Mozilla Thunderbird.
I hope they don't get angry if I use them here after all this is a open source project aswell.