A top 25 most dangerous list of software errors has been published at http://www.sans.org/top25-software-errors/

Insterestingly the top error listed was cross site scripting. So what do you do if have to accept HTML input?

I suggest that write a white list filter function to allow through only acceptable mark-up. A basis for such a function can be found in the common filter function at http://commonfilter.codeplex.com/