They can get around "javascript:" with an :bou::bou::bou::bou::bou::bou::bou:over or something though

plus typing &#whateverthenumbercodeforJis;avascript also allows them to get around it