I have been able to get several more event handlers working in place of the "on click", which proves text replacing of words "javascript" "on click" etc will not address this issue correctly.
You need to encode or replace the " and ' characters before processing bbcode, this will prevent all xss escapes. Replacing words like onClick or javascript with spaces is a bad approach that never ends, as so many different event handlers are able to be used.
`, " and ' should all be replaced htmlentities(). Using the ENT_QUOTES flag will handle both " and ', however it will not replace `, although i am unsure of any code that uses that character.
a=#" style="color:red;" ontouchstart="event.preventDefault();this.parentElement.innerText='Your cookie is:'+document . cookie;]click to show cookie[/a]
By