diff --git a/system/core/Security.php b/system/core/Security.php
index 95f65e5..93613cc 100644
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -667,8 +667,7 @@
 	 */
 	protected function _remove_evil_attributes($str, $is_image)
 	{
-		// Formaction, style, and xmlns
-		$evil_attributes = array('style', 'xmlns', 'formaction', 'form', 'xlink:href');
+		$evil_attributes = array('on\w*', 'style', 'xmlns', 'formaction', 'form', 'xlink:href');
 
 		if ($is_image === TRUE)
 		{