Fix _remove_evil_attributes()

The `_remove_evil_attributes()` method doesn't match properly and therefore can falsely manipulate the input string.

See: https://github.com/EllisLab/CodeIgniter/issues/2268