Sanitizing a form's database input while retaining basic HTML markup Is there a way to sanitize database input (say, for a comment form), which also allows for the end user to use basic HTML styling markup? As in, if a user wraps their text in &lt;i&gt;/&lt;em&gt; or &lt;strong&gt;/&lt;bold&gt;, the text gets styled, all while preventing users from entering malicious PHP and SQL commands?
There have been a few great discussions of this at Stack Overflow.  This one covers methods and processes, but don't try to create a catch-all function as a replacement for understanding your data flows.

For your particular problem, it looks like HTML Purifier might be a good fit.  That way, you could whitelist very specific HTML functionality (e.g., strong, ol, em) to prevent XSS.  In addition, you can parameterize your queries (check out Bobby Tables for PHP specifics) to prevent SQL injection.  

I wouldn't think of these two as one process, though, because they're really useful at different points in your application lifecycle:  parameterizing your SQL queries is important when you're about to make a SQL call, but XSS protection is important when displaying the saved data in a Javascript-equipped browser (as opposed to saving text to the database).