While I'd feel better about using one of the non-regexp-based BBCode solutions out there, you could do something like:
<?php
function replace($matches)
{
$myHost = 'mydomain.com'; // change this to your host
$url = trim($matches[1]);
if($url === '') {
return '';
}
$host = parse_url($url, PHP_URL_HOST);
if(!preg_match('#(.*\.)?'.preg_quote($myHost).'$#i', $host)) {
return '';
}
return "<img src='".htmlspecialchars($url)."' alt='' />";
}
$text = <<<EOD
This is a [img]http://www.mydomain.com/images.png[/img] test.
It is only a [img]http://www.anotherdomain.com/images.jpg[/img] test.
EOD;
$text = preg_replace_callback('#\[img\](.*?)\[/img\]#', 'replace', $text);
echo "<pre>".htmlspecialchars($text)."</pre>"; // test output