535 ways to reload the page with JavaScript
Yet another demonstration, if you needed it, on why blacklisting user input to avoid code injection is highly unlikely to succeed.  There are many ways to skin a cat, and you only need to miss one.You can also assume that the bad guys start with a list similar to this and tools to semi-randomly perturb their inputs until they find the right combo of hocus-locus to get past your filter and then "neutralized" by your regular expression magic into functioning exploit code.(n.b. I'm talking about more interesting attacker goals than forcing a reload, obviously.)