OK, but now write one that doesn't block words like "sextant" or "bombast." I remember using a BBS in the '80s that had a filter like this; it was really hard discussing the Kennedy ass-ass-ination.

Also, if it is only Javascript validation, a malicious user can just turn off Javascript to get around it, or maybe just tamper with the HTTP after the browser is done with it.

Validation should be done both at the entry level as well as the server. Banning inappropriate words is not as easy as it sounds and should also include things like viagra etc.. for spammers. Most routines out there will not capture this:

a s s :)