Your proposal only closes a few possible holes. This is worse than nothing, because it creates a false sense of security. The reason is that JavaScript code t

Your proposal only closes a few possible holes. This is worse than nothing, because it creates a false sense of security. The reason is that JavaScript code trusts the DOM in many and varied ways, and can thereby be tricked into doing unexpected things by plain HTML code. Consider a page using a calendar.js plug-in, and a user-provided element '<div class="calendar" month="13">...</div>'. This could easily result in JavaScript code being configured with hostile parameters and event handlers being bound to hostile elements. The only way to handle complex user-provided input is to start with a blank slate, parse the input completely, and only create output that is proven safe.