I've found this by an accident!!!
document._createElement = document.createElement;
document.createElement = function(tagName, password) {
if (tagName != "SCRIPT" || password == "My scripts are OK!") {
return document._createElement(tagName);
}
};
just that and your site will be protected
