Escaping is important for all text fields, and I never use user text to build SQL strings without using some kind of typed parameter API. But I'd like to let t

Escaping is important for all text fields, and I never use user text to build SQL strings without using some kind of typed parameter API. But I'd like to let the user submit formatted HTML via something like FCKEditor and have it checked against a limited whitelist. I don't trust my own knowledge of browser-specific HTML rules to do this on my own. It's got to be a common enough scenario, right?