Congratulations, you've just stopped one particular attack.

There'll be something you forget. Blacklisting is only a good idea if whitelisting isn't possible. (see the \w above)

eg. You forgot. javascript:alert(document.cookie) Which depends on click and in and of itself isn't dangerous but a symptom of a greater problem.

edit: except you need to allow more than \w.