What are the security vulnerabilities in the following script?

[Gingechilla]

I'm attempting to clean out all unwanted input from user posted data. The user can put anything in the input box but when it goes through to my php page I filter through it with the following:

 

function cleanxss($input)
{
	/// Prevents XXS Attacks www.itshacked.com
	$search = array(
					'@<script[^>]*?>.*?</script>@si',   // Strip out javascript
					'@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
					'@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
					'@<![\s\S]*?--[ \t\n\r]*>@'         // Strip multi-line comments
					);

	$inputx = preg_replace($search, '', $input);
	$inputx = trim($inputx);
	if(get_magic_quotes_gpc())
	{
		$inputx = stripslashes($inputx);
	}
	$input = htmlspecialchars($input);
	/// MYSQL USE ONLY: $inputx = mysql_real_escape_string($inputx);
	return $inputx;

}		


//apply the function to an array of user submitted data...
///$_POST = array_map('clean', $_POST);

//or individually like...
$message = cleanxss($_POST['data']);

 

I've pasted all the data from http://ha.ckers.org/xss.html into the form and it results in no vulnerabilities. Is this right?

 

[Gingechilla]

Oh and the data from the form will be used between other elements and saved in a file for inclusion into the main file. So for example the data from the form might be between stylesheet tags ect.

 

Only thing I can think of would be importing a CSS file like so:

@import'http://ha.ckers.org/xss.css';