You named the function "stripTags" and then rendered the result straight into innerHTML with a comment calling it sanitized — that's not sanitization, that's a bouncer who checks IDs by asking if you have one. `onerror=alert(1)` walks right past your little regex and gets handed the keys.