title: XSS filter to remove all scripts
body: <p>I am implementing an XSS filter for my web application and also using the ESAPI encoder to sanitise the input.</p>
  
  <p>The patterns I am using are as given below,</p>
  
  <pre><code> // Script fragments
  Pattern.compile("&lt;script&gt;(.*?)&lt;/script&gt;", Pattern.CASE_INSENSITIVE),
  // src='...'
  Pattern.compile("src[\r\n]*=[\r\n]*\\\'(.*?)\\\'", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
  Pattern.compile("src[\r\n]*=[\r\n]*\\\"(.*?)\\\"", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
  // lonely script tags
  Pattern.compile("&lt;/script&gt;", Pattern.CASE_INSENSITIVE),
  Pattern.compile("&lt;script(.*?)&gt;", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
  // eval(...)
  Pattern.compile("eval\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
  // expression(...)
  Pattern.compile("expression\\((.*?)\\)", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL),
  // javascript:...
  Pattern.compile("javascript:", Pattern.CASE_INSENSITIVE),
  // vbscript:...
  Pattern.compile("vbscript:", Pattern.CASE_INSENSITIVE),
  // onload(...)=...
  Pattern.compile("onload(.*?)=", Pattern.CASE_INSENSITIVE | Pattern.MULTILINE | Pattern.DOTALL)
  </code></pre>
  
  <p>But, still a few script are not getting filtered specially the one which are appended to a parameter like </p>
  
  <blockquote>
    <p>url?sourceId=abx;<strong>alert('hello');</strong></p>
  </blockquote>
  
  <p>How do I handle these?</p>