<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:arial, helvetica, sans-serif;font-size:12pt"><DIV></DIV>
<DIV>Yes, Earl, it would be - if it worked. The problem is that it removes the "script" tag itself, but not the script text. There is an open core issue on this. The same problem applies to "style" as well. I started with filter_xss and a custom list of safe tags.<BR> </DIV>
<P><FONT face="bookman old style, new york, times, serif" color=#ff007f size=4><EM><STRONG>Nancy E. Wichmann, PMP</STRONG></EM></FONT></P>
<P><FONT face="arial, helvetica, sans-serif">Injustice anywhere is a threat to justice everywhere. -- Dr. Martin L. King, Jr.</FONT></P>
<DIV><BR></DIV>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: arial, helvetica, sans-serif"><BR>
<DIV style="FONT-SIZE: 10pt; FONT-FAMILY: arial, helvetica, sans-serif"><FONT face=Tahoma size=2>
<HR SIZE=1>
<B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Earl Miles <merlin@logrus.com><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> development@drupal.org<BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Thu, June 10, 2010 5:58:02 PM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [development] Strip_tags and JS<BR></FONT><BR>On 6/10/2010 12:39 PM, Jamie Holly wrote:<BR>> $text= preg_replace('/<script.*?<\/script>/xmsi', '', $text) should do<BR>> the trick.<BR><BR>$text = strip_tags(filter_xss_admin($text)) is easier.<BR></DIV></DIV></div></body></html>