Since you're embedding text that can potentially contain XML magic characters in an XML document. Which XML won't like. And even if you don't offend, any tool you used to pretty up the XML would chew up the JavaScript code formatting unless you wrapped it with a CDATA.
However, there are a couple of other problems here.
First of all, that's not how you'd attach javascript to a control, so it still won't work.
Secondly, onpaste() is not a standard JavaScript event. It works in IE and it works in Safari, but it does not work in Firefox and probably doesn't work in Opera.
So if you expected to set up a website that was trying to sell me something, you'd fail. I don't use IE for anything where money or sensitive data are involved.
Customer surveys are for companies who didn't pay proper attention to begin with.