Well, it can be tricky, often times the XSS attack is masked quite deeply, but there are known methods. PHP strip_tags will assist, though would need to be beef

Well, it can be tricky, often times the XSS attack is masked quite deeply, but there are known methods. PHP strip_tags will assist, though would need to be beefed up a bit to handle the onclick, onhover, onblur, onfocus, etc events. In this particular case, simply looking for `javascript:` would have done the trick.