stripLargeTags() should not be used to sanitize user input, as it is not safe. For example, one could use: -------------- <scri<!blabla>pt language="javascript">alert("JS injection");</script> -------------- Note: the html entities < and > are encoded, in order to bypass this f* (fine) and c* (creative) blogging script, wordpress :) The regex replacements are done in the specified order, and removal is before removal. Therefore, the pattern won't replace anything, but will be removed afterwards and you'll end up with some valid tag that won't get removed. Possible solutions (only if you're planning on using stripLargeTags for untrusted input, otherwise there's no problem): 1. Use the pattern in increasing order of importance (resulting in being the last pattern). 2. Apply the patterns more times, until none of them match. 3. Do not make the match of tag ending mandatory (i.e. ) Note: This solutions are probably not enough, one could find other ways of making the pattern not match. Another way one could avoid the removal is by using a tab character, so instead of he'll use (\t =tab character). This will prevent the pattern from replacing, but it will still be rendered by browsers (tested on IE6 and FF2)