try changing this
$url = ereg_replace('<([^>]|\n)*>', '', $url);
$button = ereg_replace('<([^>]|\n)*>', '...', $button);
to this
$url = strip_tags($url);
$url = str_replace(array("\r", "\n"), '', $url);
$button = strip_tags($button);
$button = str_replace(array("\r", "\n"), '', $button);
btw- you should consider searching for a better script, i see lots of little holes in it. sorry, i cant recomend one because i just code my own, so i dont know of any.
either the person doing this pretty clever, or they were familiar with this script, and so they knew where the security holes were.