> selectively parse out the original and recreate what is explicitly allowed. This is the ONLY solution. trying to blacklist and escape characters is ultimatel

> selectively parse out the original and recreate what is explicitly allowed. This is the ONLY solution. trying to blacklist and escape characters is ultimately trying to push your parsing problem down to the browser, and what will you do when the browser contains a bug that someone can exploit to steal your own credentials on the web app? I'm a strong believer in using JS to inject unsafe text directly into the DOM. If you want people to mark stuff up, give them a markup language that you parse. Note that Markdown has its issues: If you use a library to parse it, be aware that html is valid markdown, so you're just moving the HTML escape problem around.