Sanitizing a form's database input while retaining basic HTML markup
There have been a few great discussions of this at Stack Overflow.  This one covers methods and processes, but don't try to create a catch-all function as a replacement for understanding your data flows.

For your particular problem, it looks like HTML Purifier might be a good fit.  That way, you could whitelist very specific HTML functionality (e.g., strong, ol, em) to prevent XSS.  In addition, you can parameterize your queries (check out Bobby Tables for PHP specifics) to prevent SQL injection.  

I wouldn't think of these two as one process, though, because they're really useful at different points in your application lifecycle:  parameterizing your SQL queries is important when you're about to make a SQL call, but XSS protection is important when displaying the saved data in a Javascript-equipped browser (as opposed to saving text to the database).