(based on DizzyTech post in area51).
2 small xhtml violations:
1: in posting_attach_body.html, which, in itself, is completely embedded in a table, the javascript code is outside any <tr> or<th> element. this is a violation, as, if i understand correctly, <tr> and <th> are the only legal elements in a table.
2: again, in the same file, you have
<textarea class="post" name="filecomment" rows="3" cols="35" size="40">
"size" is not a valid attribute for a textarea.

HINT:

use http://validator.w3.org" target="_blank
it is a bit challenging to test "posting", especially if you dont allow guest posting, because the validator is not a registered user.
one way of doing it is to get to any specific page, use your browser's "view source", select all, copy, and use the textarea in the validator to paste the whole page.
this way you can validate any page, including pages in posting, private messages, profile, acp/mcp etc., and even without publishing your fixes on the web.