No, as it seems to indicate you are using jQuery (adept at parsing out information from HTML tags) to do input validation on the user inputting HTML that you will then display back to the user. Whitelisting safe HTML tags, and blacklisting unsafe HTML tags is the wrong method to preventing XSS.
The right method is using a lightweight markup language like Markdown or reStructuredText for user input of formatted data (like blog posts, comments, etc). This way the user can stylize their text in whatever they want, add bold text or links within their comment with a syntax like **make this bold**
or [text for a link](http://www.example.com/fake/link)
which it always converts into html to be displayed like <a href="http://www.example.com/fake/link">text for a link</a>
in the user's browser. This let's you completely prevent say <script>
inserting javascript files, or onclick
onmouserover
form
with action attributes as your limited safe markup language is set to not allow those tags or general attributes.
Granted you have to set your language to be in a safe_mode
where special characters specifically <
, >
, &
, "
, '
are HTML-escaped (into <
, >
, &
"
, and '
which will be seen by the user as the real character without being interpreted by the browser as part HTML source), (attributes=false
) attributes aren't allowed to be inputted (e.g., onclick
), as well as requiring links to start with a limited whitelist; e.g., http
, //
, /
, ftp
, mailto
, news
, so you don't inadvertently let users input javascript
as the protocol in their links.
(This can also be accomplished by filtering the raw input through HTML purifier, if you want your users to be able to write straight-HTML like in Hendrik's answer.)
By doing this with a mature lightweight markup language, you won't forget to miss removing something regardless of how obscure it is or how your jQuery library didn't pick up on malformed HTML while sanitizing it, but one particular browser did.