Although there is some movement towards smarter input controls these days, I think that the HTML INPUT TYPE=TEXT control is still basically stuck with unrestricted characters, and it's what determines what the JSF equivalent (inputText) tag will accept.
An IDE is no substitute for an Intelligent Developer.
Note that you can't use < or >, so you have to use & lt; and & gt; (without the space between the &), but this forum
is displaying it like it is. I think event.which is preferred to event.keyCode, but the latter is an option.