That code is exploitable, you are double evaluating $chan in the timer while $chan is unknown and could be something like #$q..


#mircscripting @ irc.swiftirc.net == the best mIRC help channel