Defenses: Keywords stripped (single pass, case-insensitive): script, alert, onerror, onload, onclick, onfocus, onmouseover, javascript, eval, prompt, confirm.
script, alert, onerror, onload, onclick, onfocus, onmouseover, javascript, eval, prompt, confirm
Dangerous keywords are stripped in a single pass. Can you reconstruct them?