For Thomas

[alexey_dv]

Thomas, hello,

You have changed a part of a code:

- $body = preg_replace('/(<[^!][^>]*?\s)(on\w+?)(=[^>]*?>)/im', '$1__removed=$3', $body); 
+ $body = preg_replace('/(<[^!][^>]*?\s)(on[^=]+)(=[^>]*?>)/im', '$1__removed=$3', $body); 

Test example:

<img src="..." alt="Picture on test page"/>

The text which will be destroyed...

<a href="Thanks"> It is safe, but incorrectly </a> 

Result after parsing:

<img src="..." alt="Logo __removed=="Thanks"> It is safe, but incorrectly </a> 

It is possible to use:

+ $body = preg_replace('/(<[^!][^>]*?\s)(on[^=>]+)(=[^>]*?>)/im', '$1__removed$3', $body); 

or:

+ $body = preg_replace('/(<[^!][^>]*?\s)(on[^\W\S]+)(=[^>]*?>)/im', '$1__removed$3', $body); 

---

[thomasb]

I prefer to use (on[^=>]+) because <img onload.="alert(document.cookie)" /> works fine in any browser and is not removed with (on[^\W\S]+)

Sorry for destroying all your patches again.