Move _remove_evil_attributes() call

1 files changed, 3 insertions, 4 deletions

diff --git a/system/core/Security.php b/system/core/Security.php
index ade77491d..dd3b2c8f0 100644
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -480,12 +480,8 @@ class CI_Security {
 			}
 		}
 		while ($original !== $str);
-
 		unset($original);
 
-		// Remove evil attributes such as style, onclick and xmlns
-		$str = $this->_remove_evil_attributes($str, $is_image);
-
 		/*
 		 * Sanitize naughty HTML elements
 		 *
@@ -518,6 +514,9 @@ class CI_Security {
 		while ($old_str !== $str);
 		unset($old_str);
 
+		// Remove evil attributes such as style, onclick and xmlns
+		$str = $this->_remove_evil_attributes($str, $is_image);
+
 		/*
 		 * Sanitize naughty scripting elements
 		 *