Fixed the security hole (really, I'm a moron - used $failed > $threshold instead of $failed >= $threashold) and patched up some...erm... math issues
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>{$lang_searchreplace_replace_title}</title>
<script language="javascript" type="text/javascript" src="../../tiny_mce_popup.js"></script>
<script language="javascript" type="text/javascript" src="../../utils/mctabs.js"></script>
<script language="javascript" type="text/javascript" src="../../utils/form_utils.js"></script>
<script language="javascript" type="text/javascript" src="jscripts/searchreplace.js"></script>
<link rel="stylesheet" type="text/css" href="css/searchreplace.css" />
<base target="_self" />
</head>
<body onload="tinyMCEPopup.executeOnLoad('init();');" style="display: none; margin: 4px;">
<form onsubmit="return false;" action="#">
<div class="tabs">
<ul>
<li id="search_tab"><span><a href="javascript:mcTabs.displayTab('search_tab','search_panel');manageReplaceButtons();" onmousedown="return copyValues(this);">{$lang_searchreplace_search_desc}</a></span></li>
<li id="replace_tab"><span><a href="javascript:mcTabs.displayTab('replace_tab','replace_panel');manageReplaceButtons();" onmousedown="return copyValues(this);">{$lang_searchreplace_replace}</a></span></li>
</ul>
</div>
<div class="panel_wrapper">
<div id="search_panel" class="panel">
<table border="0" cellspacing="0" cellpadding="2">
<tr>
<td><label for="search_panel_searchstring">{$lang_searchreplace_findwhat}</label></td>
<td><input type="text" id="search_panel_searchstring" name="search_panel_searchstring" style="width: 200px" /></td>
</tr>
<tr>
<td colspan="2">
<table border="0" cellspacing="0" cellpadding="0" class="direction">
<tr>
<td><label>{$lang_searchreplace_direction}</label></td>
<td><input id="search_panel_backwardsu" name="search_panel_backwards" class="radio" type="radio" /></td>
<td><label for="search_panel_backwardsu">{$lang_searchreplace_up}</label></td>
<td><input id="search_panel_backwardsd" name="search_panel_backwards" class="radio" type="radio" /></td>
<td><label for="search_panel_backwardsd">{$lang_searchreplace_down}</label></td>
</tr>
</table>
</td>
</tr>
<tr>
<td colspan="2">
<table border="0" cellspacing="0" cellpadding="0">
<tr>
<td><input id="search_panel_casesensitivebox" name="search_panel_casesensitivebox" class="checkbox" type="checkbox" /></td>
<td><label for="search_panel_casesensitivebox">{$lang_searchreplace_case}</label></td>
</tr>
</table>
</td>
</tr>
</table>
</div>
<div id="replace_panel" class="panel">
<table border="0" cellspacing="0" cellpadding="2">
<tr>
<td><label for="replace_panel_searchstring">{$lang_searchreplace_findwhat}</label></td>
<td><input type="text" id="replace_panel_searchstring" name="replace_panel_searchstring" style="width: 200px" /></td>
</tr>
<tr>
<td><label for="replace_panel_replacestring">{$lang_searchreplace_replacewith}</label></td>
<td><input type="text" id="replace_panel_replacestring" name="replace_panel_replacestring" style="width: 200px" /></td>
</tr>
<tr>
<td colspan="2">
<table border="0" cellspacing="0" cellpadding="0" class="direction">
<tr>
<td><label>{$lang_searchreplace_direction}</label></td>
<td><input id="replace_panel_backwardsu" name="replace_panel_backwards" class="radio" type="radio" /></td>
<td><label for="replace_panel_backwardsu">{$lang_searchreplace_up}</label></td>
<td><input id="replace_panel_backwardsd" name="replace_panel_backwards" class="radio" type="radio" /></td>
<td><label for="replace_panel_backwardsd">{$lang_searchreplace_down}</label></td>
</tr>
</table>
</td>
</tr>
<tr>
<td colspan="2">
<table border="0" cellspacing="0" cellpadding="0">
<tr>
<td><input id="replace_panel_casesensitivebox" name="replace_panel_casesensitivebox" class="checkbox" type="checkbox" /></td>
<td><label for="replace_panel_casesensitivebox">{$lang_searchreplace_case}</label></td>
</tr>
</table>
</td>
</tr>
</table>
</div>
</div>
<div class="mceActionPanel">
<div style="float: left">
<input type="button" id="insert" name="insert" value="{$lang_searchreplace_findnext}" onclick="searchNext('none');" />
<span id="replace_buttons">
<input type="button" id="replaceBtn" name="replaceBtn" value="{$lang_searchreplace_replace}" onclick="searchNext('current');" />
<input type="button" id="replaceAllBtn" name="replaceAllBtn" value="{$lang_searchreplace_replaceall}" onclick="searchNext('all');;" />
</span>
</div>
<div style="float: right">
<input type="button" id="cancel" name="cancel" value="{$lang_searchreplace_cancel}" onclick="tinyMCEPopup.close();" />
</div>
</div>
</form>
</body>
</html>