It is possible to fool strip-tags

[engelfrost]

'<scr<script></script>ipt> alert(document.cookie);</scr</kj>ipt>' turns into <script> alert(document.cookie);</script>.

The simpler regexp /<[^>]+>/g does strip the HTML.