PHP allow template to use HTML only
I did some testing and research on this, AFAIK your script is safe.

However, you should also be aware of how you retrieve the input. For example, what if the String contained a ", followed by executing PHP code. This would be an even worse vulnerability than malicious client-side code.

This post states old versions of IE may be vulnerable if your char-set is UTF-7, which it probably isn't.

If &lt;div style...&gt; is entered, it will be escaped. Therefore &lt;div&gt; and &lt;span&gt; should be included.

I believe every tag can have an onload=script, (E.G &lt;u onload="script"&gt;), so only allowing tags by themselves is a good idea. (As you are already doing)

I suggest adding div, span, b, br and many other tags to the whitelist.

Edit: Since you mentioned you use PHP to echo the output, I also suggest testing using PHP functions or variables  in the input, such as $_SERVER['REMOTE_ADDR']. 

Will the output show the result of that variable, or the literal text?