xss_clean dosen't work propertly

[eluser]Paul Burdick[/eluser]
No, I did understand that, droopy. However, the ability to insert JavaScript that way and the ability to actually perform an XSS Attack are two different things. For example, your alert() will not work, nor will getting cookies because we remove that kind of code. We wanted you to actually show us something that got past the filter and did actual harm. Changing colors was not harmful.

However, it does point out a weakness in the XSS filtering, so we are going to be hard on it and challenge the usage of expression() in submitted data just to be safe.