EllisLab/CodeIgniter — pull request #2049 by brian978 (2012-12-03 19:50:29+00:00)
Title: Added small improvement to the _remove_evil_attributes function

I reversed the order in which the illegal attributes where matched because in some cases they were not removed entirely. For example the following string
``
would have been cleaned like so: ``.

With the new change the style attribute get's removed entirely: ``

The second modification fixes a bug in the regexp that is used to find and replace the attributes. The regexp would have failed in case the following string was passed to the xss_clean function: `" onfocus="alert(\'test\');"`. This XSS could be applied to an input box that takes it's value from GET/POST. With the new modifications, the XSS gets filtered.