How to filter HTML user input?

Hey, I'm trying to allow users to post an HTML-formatted bio on themselves.... We'll also be running AJAX. I don't want to set up a collision course here, so I need to filter out all Javascript. [minicode]strip_tags()[/minicode] won't quite get this (if I allow <a> tags, etc., which I will):

HTML Code:

---

<a href="javascript:something" onclick="someJS()">foo</a>

---

What can I do?

BUMP.
Somebody here has to do this. How can I safely filter user input in PHP?

Take a look at strip_tags().

Quote:

---

Originally Posted by eKstreme

Take a look at strip_tags().

---

Won't that still allow my example?

Best way then is to have pseudo-HTML, like BBCode used right here on WDF. That way, you can check the URL before actually turning it into a link.

Clarification:
I want to allow HTML, just not dangerous HTML. Is that asking the impossible?

BBCode is the answer, unless you want to do tons of regex to pare down the HTML input into the accepted tags.