Cross Site Scripting prevention

ahh, but it also needs to include events as well, eg "onmouseover","onhover" and links to "javascript:"

This is what I came up with. I'm sure its not 100% proof but I have tried a lot of test cases

#remove <script ...>...</script> tags
$string =~ s/<script(.*?)>(.*?)<\/script>//sig;

#remove onmouseover etc
my $event_attribs = '(?:on(blur|c(hange|lick)|dblclick|focus|keypress|(key|mouse)(down|up)|(un)?load|mouse(move|o(ut|ver))|reset|s(elect|ubmit)))';
$string =~ s/<(.*?)$event_attribs=(.*?)(\s*?)(.*?)>/<$1>/sig;

#remove href=javascript:
$string =~ s/<a(.*?)href=(\"?)javascript\:(.*?)>/<a>/sig

That last one should actually be

$string =~ s/<(.*?)javascript\:(.*?)/<$1>/sig;