Hi, just noticed this extension and I see some issues with code:
- First of all, great to see that this extension is XSS-safe, however you don't need to apply escaping to $wgIBMsize - it is not outputted to pages directly.
- We use prefix wg for global configuration variables (wg stands for "wiki global"), you don't need to use it for internal variables.
- wfMsg*() functions are used to retrieve messages from message files and optionally transform them (by parsing wikitext, substituting parameters like $1 with provided values and so on). They can't be used with random input like wfMsgForContent('uncorrect id: '). See Localisation for details.