title: javascript unbind dom events
body: <p>I'm working on a web framework and am trying to build XSS prevention into it. I have set it up so it will escape incoming data for storage in the database, but sometimes you want to save html that the user generates. I am trying to make a custom tag that will prevent any javascript from executing, here is my first hack at it:</p>
  
  <pre><code>&lt;html&gt;
    &lt;head&gt;
      &lt;script type="text/javascript" src="/js/jquery.min.js"&gt;&lt;/script&gt;
    &lt;/head&gt;
    &lt;body&gt;
  
      &lt;preventjs&gt;
        &lt;div id="user-content-area"&gt;
          &lt;!-- evil user content --&gt;
            &lt;p onclick="alert('evil stuff');"&gt;I'm not evil, promise.&lt;/p&gt;
            &lt;p onmouseover="alert('evil stuff');"&gt;Neither am I.&lt;/p&gt; 
          &lt;!-- end user content --&gt;
        &lt;/div&gt;
      &lt;/preventjs&gt;
  
      &lt;script type="text/javascript"&gt;
        // &lt;preventjs&gt; tags are supposed to prevent any javascript events
        // but this does not unbined DOM events
        $("preventjs").find("*").unbind();
      &lt;/script&gt;
  
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>I tried using jQuery to unbind everything, but it doesn't unbind events in the DOM, which is exactly what I'm trying to do. Is it possible to unbind all events for a DOM element?</p>