I\'ve been doing server side XSS validation. Here is what I found to use: List of forbidden attributes: javascript:,mocha:,eval(,alert(,vbscript:,livescript:,expressio
javascript:,mocha:,eval(,alert(,vbscript:,livescript:,expressio