[@BBeast], [@Captain Jordan]: Good idea on [noparse][roll]1234[/roll][/noparse]!

Maybe something like:

Gooseblight slaughters the goblin [noparse][roll]1234[/roll][/noparse] 
→ Gooseblight slaughters the goblin [img]http://i.imgur.com/9v3dxFn.png[/img][url]1234[/url]

Where clicking the die can show the roll details in a simple, dismissible pop-over.

[quote=@LegendBegins]
[quote=@Mahz]
Can't allow HTML/CSS without heavy pre-processing to enforce a whitelist of safe usage.

Which is exactly what BBCode is. :lol
[/quote]

I really would recommend against implementing code for HTML. No matter how many holes you cover up, someone will be able to break it; that system is too vulnerable.
[/quote]

Yeah, BBCode is still a leaky abstraction. There's always a trade-off between giving users expressive tools and limiting the abuse of bad actors.