Input Lib: XSS Clean

[eluser]louis w[/eluser]
Maybe not a "bug" but something that should be thought about and possibly improved.

With global xss clean on, someone is able to manipulate the output of page by injecting html into a variable when that variable is being output directly to the browser (e.g. to pass long to the next stage of a form)

Example:
destination = whatever"><h1>Hello</h1>youwhat