Remove event handler attributes: attributes that have no namespace and a name starting with on.
Add tests to check if dangerous input is loaded without executing javascript.