I already know how XSS works, but finding out all the many different ways to inject malicious input is not an option.
I saw a couple libraries out there, but most of
I'm surprised it's not been mentioned here, but I prefer htmlAwed to htmlPurifier. It's up-to-date, nicely licensed, very small and really fast.