Fix issue with XSS sanitizing

XSS sanitizing had an issue with on* attributes, taking into account the
whitespaces such that "on something" was filtered out.