obliterating many (if not all) XSS vectors. although script injection was not working before this, now its not even allowed in any sense. adding String.safe() which removes <script> tags, also making sure the Template object AND barfr filter out all script tags from displayed content. like i said, script injection wasnt even working before (<script>alert("hai");</script> wouldnt open an alert) but now <script> tags are completely filtred anyway, so even less chance of an attack. bitchin.