In fact, under existing legislation they could have added 'script src' and 'drop table' to an existing list of sensitive words that aren't allowed.

Then someone should register a company named "<FONT FACE='COMIC SANS MS' COLOR='#0F0'>"