[eli]

They could have done a similar attack with an <IMG> tag. Or do you block images too?

[repsilat]

Erm, you don't? I suggest you read the Basilisk FAQ before you get into real trouble...

http://ansible.uk/writing/c-b-faq.html

[therealidiot]

Something like Request Policy could cover this