> Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display. An evil par

> Also, you're putting users without sandbox attribute support on risk of being exploited... so you'd have to switch between two paths for display. An evil part of me considers that a feature, not a bug. And as for stripping script tags, I'm always reminded of this story: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl...