Does this set of regular expressions FULLY protect against cross site scripting?

Question

What\'s an example of something dangerous that would not be caught by the code below?

EDIT: After some of the comments I added another line, commented below. See V

Answer 1

You're much better off turning all < into < and all > into >, then converting acceptable tags back. In other words, whitelist, don't blacklist.