Believe it or not, I saw a security issue in this code in under 20 seconds, because of something I saw at work recently.

https://www.jitbit.com/alexblog/256-targetblank---the-most-underestimated-vulnerability-ever/

Will this fix the security issue?

<?php
/**
This extension adds the ability to nearly use wiki syntax to create an external image with a link/url behind it.

Copyright (C) 2012 by
Christof Alber,
Mario Kleinsasser,
Markus Neuhold,
Bernhard Rausch,
Martin Steinwender

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*/

$wgExtensionCredits['parserhook'][] = array(

'path' => __FILE__,
'name' => 'Image with Link',
'author' =>'Christof Alber, Mario Kleinsasser, Markus Neuhold, Bernhard Rausch, Martin Steinwender', 
'url' => 'https://www.n0r1sk.com', 
'description' => 'This extension adds the ability to nearly use wiki syntax to create an external image with a link/url behind it - by [http://www.n0r1sk.com n0r1sk.com]',
'version'  => 0.1,
);

$wgHooks['ParserFirstCallInit'][] = 'ImageWithLinkInit';

function ImageWithLinkInit( &$parser ) {
$parser->setHook( 'iwl', 'ImageWithLink' );
return true;
}

function ImageWithLink( $input, array $args, Parser $parser, PPFrame $frame ) {
/** $output = $parser->recursiveTagParse( $input, $frame); */
list($image, $link, $text) = explode("|", $input);
$output = '<a href="' . $link . '" target="_blank" rel="noopener noreferrer"><img src="' . $image . '" alt="' . $text . '" title="' . $text . '"></a>';
return $output;
}

Well, uh, no. This is not secure either. This is vulnerable to Cross-Site Scripting, pretty obviously. Imagine someone did this:

{{iwl|#" onclick="alert('omg youve been hacked')"|#|#}}

As usual the correct thing to do here would be to use the Html class, probably:

Html::rawelement( 'a', [

  'href' => $link,
 'target' => '_blank',
 'rel' => "noopener noreferrer"
], Html::element( 'img', [ src => $image, 'alt' => $text, 'title' => $text ])

);