Improves and corrections

Hi, my suggestions for the project.

In line 119:
$whitelist = array_filter(split("[\n|\r]", $var), 'trim');

The caracter | dont's separator of caracters. Then, itself is includes.

Example:

That's expected?

In line 294:
    $pattern = '@( on[^=]+?=([\'"])([^\\2]+?)\\2)?@i';

It's don't works were expected... See:
preg_match('/([\'"])[^\1]+\1/', "''\"\"'", $m); print_r($m);

Documentation:

Outside a character class, a backslash followed by a digit greater than 0 (and possibly further digits) is a back reference to a capturing subpattern earlier (i.e. to its left) in the pattern, provided there have been that many previous capturing left parentheses.

http://br2.php.net/manual/en/reference.pcre.pattern.syntax.php

Regards,
Felipe.