$string =~ s/\</\&lt\;/g; 
$string =~ s/\>/\&gt\;/g; 
$string =~ s/[\"\'\}\{\)\(\+]//g;                 # Why???
$string =~ s/<!(?:--[\s\S]*?--\s*)?>\s*//g;       # Never matches
$string =~ s/[\~\^]//g;                           # Why???
$string =~ s/~!/ ~!/g;                            # Why???
$string =~ s/<*(javascript)[^>]+>//gi;            # Never matches
$string =~ s/(<[\s\/]*)(script\b[^>]*>)/$1x$2/gi; # Never matches
$string =~ s/<*(iframe)[^>]+>//gi;                # Never matches
$string =~ s/<*(script)[^>]+>//gi;                # Never matches
[download]

Those that never match don't match because < and > have been replaced. I didn't look at how useful they are by themselves.

You escape only two of the three HTML chars that differentiate text from HTML (<, > and &).

You convert text to HTML, but you remove all formatting (by not adding <pre> or some alternative). It may make for unreadable text.

\Y\o\u \a\l\s\o \h\a\v\e \w\a\a\a\a\a\y \t\o\o \m\a\n\y \"\\\"\!

You should look closely at HTML::Scrubber and HTML::Strip. Solving this with regexes yourself is difficult and error prone. It's also fairly easy to build your own on the back of something like XML::LibXML if wanted. Here's something to play with-

use warnings;
use strict;
use XML::LibXML;

my @strip = @ARGV;
@strip || die "Give a list of tags to strip.\n";

my $parser = XML::LibXML->new();
$parser->recover(1);
$parser->keep_blanks(1);
$parser->line_numbers(1);

my $raw = join '', <DATA>;
my $doc = $parser->parse_html_string($raw);

my $root = $doc->documentElement();

for my $strip ( @strip )
{
    for my $node ( $root->findnodes("//$strip") )
    {
        my $fragment = $doc->createDocumentFragment();
        $fragment->appendChild($_) for $node->childNodes;
        $node->replaceNode($fragment);        
    }
}

# entire HTML doc: print $doc->serialize(1);

print $_->serialize(1) for $doc->findnodes("//body/*");

__END__
<div>
    <h1>Bang!<sup>1</sup></h1>
    <p>Did <i>italic</i> and <a href="/uri">link with <b>bold</b>
       inside it</a>.</p>
<script type="whatever/whatnot">doSomethingTerrible()</script>
 <a href="/top-level">naked link</a>
    <p><i>The</i> <b>content</b> of the body <sup>element</sup> is
       displayed in your <span>browser</span>.</p>
</div>
[download]

The nice thing about this snippet is that it only removes the disallowed tags, not the content within the tags.

Calling $q->param will give you a list of all field names from the cgi object. Something like the following untested code should apply your regexes to each field value.

my @fields = $q->param;
for my $name ( @fields ){
    my @vals = $q->param($name);
    for my $value( @vals ){
        # apply regexes here
        $value =~ s/...
        $value =~ s/...
        $value =~ s/...
    }
    if (@vals > 1){
        $q->param(name => $name, values => [ @vals ]);
    }else{
        $q->param(name => $name, value => $vals[0] );
    }
}
[download]

Update: Applied correction and clarification per post below. Thanks Mom, I'll try not to be in such a hurry next time. ;-}

Quick clarification: there is no param object. It's just a method (or a function depending on how it's called). And if you're skipping the lexical variable in the loop already-

   $_ =~ s/...
   # is equivalent to
   s/...
[download]

You are using CGI.

I understand the excitement about finding a cool module such as PDF::API2, or CGI::Application, and you just want to use it.. skim the docs..

But here's what. Print out CGI doccumentation. Read it. No, really, read it. Don't memorize it, just read it. Maybe staple the sheets in a corner and put it under your bed when you sleep at night.

In a week or a month when you're trying to solve a problem.. Your brain will knock on your door and whisper.. Hey.. you know what.. I think I may have seen something about that in such and such docs, yeah.. remember how at the time it seemed useless and we giggled to each other about "who the heck would use such a weird method call?" - well.. here we are..