If you've run across the jPFChat scripting vulnerability post about this.... 'demo21_with_hardocded_urls.php', rest easy.  We've removed the DEMO folder from phpFreeChat before including it in jPFChat.   Therefore... the vulnerability present in phpFreeChat doesn't even exist in jPFChat!