title: Avoid XSS and allow some html tags with JavaScript
body: <p>I've got a problem in my current project:
  Users can send an email using a textarea. We allow the user to put in whatever they want, and thus some HTML for formatting.
  For example, the user should be allowed to use the <code>&lt;b&gt;</code> tag for bold text.</p>
  
  <p>After completing their email, the user should be able to view a preview of their email dynamically.</p>
  
  <p>There is a slight problem though, how can I avoid XSS hacks when the preview is being displayed?</p>
  
  <p>You can ofcourse strip them using <code>underscore.js</code>, but that wouldn't format their preview.</p>
  
  <p>So I have forbidden all HTML tags for now, and only allowed tags like <code>&lt;hr&gt;</code>, <code>&lt;b&gt;</code>, etc. </p>
  
  <p>What do you think about this solution? Is it secure enough?</p>