Thanks John for posting this as a main thread of its own. I noticed that your comment was lost in a flood of other comments in the YT thread. I don't know if yo

Thanks John for posting this as a main thread of its own. I noticed that your comment was lost in a flood of other comments in the YT thread. I don't know if you saw my comment but I mentioned your solution, while technically very solid, requires a lot more work for everyone. Why wouldn't this work: Have a meta-tag (or something in the <head>) that says: do not allow in-line script tags on this HTML page. Only run scripts from external .js files. No onclick/onmouse code allowed in HTML. For additional security (I don't know if this is possible or not), external .js files cannot do document.write("<script>...") or $("#foo").innerHTML("<script>...") i.e. if external .js file makes an Ajax call and document.write() the response, the response should be handled as non-executable. Moreover, only external .js files can attach events and that too, using attachEvent etc. and not via the on* attributes.