How to remove unsafe contents of WYSIWYG editors before use it?

Question

How to remove unsafe contents of WYSIWYG editors like script tags or iframe tags and events of other tags before use it?

<script>
// Dangerous contents
</script>

<iframe>
// bad web pages
</iframe>

<span onclick="javascript://do bad work here !!!">click me</span>

Answer 1

You shouldn't try to write such protection on your own.

Specially, you should NOT place the protection on the client side (javascript), but use instead a server side filtering like http://htmlpurifier.org/