I am using a form, onkeyup and innerHTML to display what has been typed into a text box.

I used..

function formcheck() {
lettercount=document.formname.email.value.length
if(document.formname.email.value.charAt(lettercount-1)=="<"){alert()}}

This sent an alert if someone tries to type '<' in a form to start a HTML command.

This could be used for instant form validation on the client side, but it only shows the alert when it is the LAST thing written in the box. If I could count the letters to the curser in the text box, then I could use this number to make sure nothing suspisious is written in the form.