strip_tags() and the recent CERT advisory....

Many thanks to tomjr (at) tx3 (dot) net for posting into the annotated PHP manual a simple solution to the mis-named Cross-System Scripting Attacks (http://www.cert.org/advisories/CA-2000-02.html). I was wondering if the developers could modify strip_tags($str,$allowable_tags) to optionally strip attributes from the allowable tags that are left unstripped. Also, the global solution like the one that tomjr has posted (thanks again) is, unfortunately, somewhat CPU intensive, would there be any performance gain to create some form of internal functionality to do the same? Perhaps with a php.ini flag to toggle its use? Regards, Martin Koistinen