Valid point. But I think other event handlers also need covering - if we're gonna one, we'd better cover *anything* that can trigger code.

And I guess you should strip all links that start "javascript:" - arghhhh.

So I guess we'd need to add something like:

# javascript:
$text =~ s/(["'])\s*javascript:.*?\1/"'/gis;

# event handlers (on + 4 chars is min length)
$test =~ s/\bon\w{4,}\s*=\s*(['"]).*?\1//gis;
[download]

Untested, but I think that might do the trick...

Have I missed anything?

cLive ;-)