What strings does zoobar.org not allow in profiles?
javascript: eval setTimeout setInterval window target onAbort onBlur onChange onClick onDblClick onDragDrop onError onFocus onKeyDown onKeyPress onKeyUp onLoad onMouseDown onMouseMove onMouseOut onMouseOver onMouseUp onMove onReset onResize onSelect onSubmit onUnload Keep in mind that this is an example of what not to do. Blacklisting keywords is a recipe for disaster and will annoy, but not limit, a determined attacker.
