My XSSFilter (which now has a website [1] and is available as a rock [2]) returns nil and an error message for this input. Which I think is a sensible thing to do. If you escape the angle brackets, then the tag will be included, though you will need to tell the filter to be liberal and to allow onclick and src that doesn't start with "http://".
BTW, the XML parser I am using is just Roberto's parser from the LuaXML page on the wiki.
- yuri
[1]:
http://sputnik.freewisdom.org/lib/xssfilter/
[2]: "luarocks install xssfilter"
