 <p>The simplest thing to do would be to either strip out tags with a regex. Trouble is that you could do plenty of nasty things without script tags (e.g. imbed dodgy images, have links to other sites that have nasty Javascript) . Disabling HTML completely by convert the less than/greater than characters into their HTML entities forms (e.g. &lt;) could also be an option.</p> <p>If you want a more powerful solution, in the past I have used <a href="http://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project_.NET" rel="nofollow noreferrer">AntiSamy</a> to sanitize incoming text so that it's safe for viewing.</p>