Don't use a blacklist to filter out XSS attacks. Here's a valid title: "></title></head><body onclick="a" ondblclick="a" onload="alert(1)" onmousedown="a" onm

Don't use a blacklist to filter out XSS attacks. Here's a valid title: "></title></head><body onclick="a" ondblclick="a" onload="alert(1)" onmousedown="a" onmousemove="_onmousemove_" onmouseout="a" onmouseover="asdf" onmouseup="a" onkeydown="a" onkeypress="a" onkeyup="a" onunload="a"> The other stuff is just there to mess up your filter. Just escape <, >, ", and '. And then test it to make sure there aren't other clever attacks.