Downvoted because "this will virtually never happen" is, uhm, for want of a better term, incredibly stupid.

Allow what you want to allow and disallow everything else.

downvoted for assuming that "chance of happening in random usage" has any correlation to what a determinated user will actually try to do.

This is like saying "oh, but nobody will ever insert SQL in our forms!"

good point.

Unless you run a blogging platform which is used by JS programmers.