PHP allow template to use HTML only I have a place where i have to include a HTML template.
The HTML is written by employees only but i dont wanna be an idiot and include it without masking|checks :)

It should allow HTML tags only without any attributes.

So no &lt;a href... links and no &lt;div style=... divs or w/e.

My test script:

$string
    = '
&lt;p&gt;
    &lt;strong&gt;Foo&lt;/strong&gt;
&lt;/p&gt; 
&lt;p&gt;Bar&lt;/p&gt; 
&lt;p&gt;
    &lt;strong&gt;Baz&lt;/strong&gt;&amp;nbsp;Mmmpf
&lt;/p&gt;
&lt;ul&gt;
    &lt;li&gt;someting&lt;/li&gt;
    &lt;li&gt;someting more&lt;/li&gt;
    &lt;li&gt;even more&lt;/li&gt;
&lt;/ul&gt; 
&lt;p&gt;
    &lt;strong&gt;Foo&lt;/strong&gt;
&lt;/p&gt; 

&lt;i&gt;Foo &lt;u&gt;Bar&lt;/u&gt;&lt;/i&gt;Baz

&lt;!-- xss --&gt;
&lt;script&gt;alert(1)&lt;/script&gt;
&lt;p onmouseover="alert(1)"&gt;&lt;/p&gt;
&lt;!-- ... --&gt;
';


$htmlWhitelist = [
    'u',
    'i',
    'p',
    'strong',
    'ul',
    'li',
];
// replace allowed tags with placeholders 
// that not get changed by htmlspecialchars()
foreach ($htmlWhitelist as $tag) {
    $string = str_replace(
        ["&lt;{$tag}&gt;", "&lt;/{$tag}&gt;"],
        ["{OPEN}{$tag}{OPEN}", "{CLOSE}{$tag}{CLOSE}"],
        $string
    );
}
// htmlspecialchars() on everything
$string = htmlspecialchars($string);
// put back the allowed tags
foreach ($htmlWhitelist as $tag) {
    $string = str_replace(
        ["{OPEN}{$tag}{OPEN}", "{CLOSE}{$tag}{CLOSE}"],
        ["&lt;{$tag}&gt;", "&lt;/{$tag}&gt;"],
        $string
    );
}


I cannot imagine anything could go wrong with this but would like to ask you guys if i missed someting.
I did some testing and research on this, AFAIK your script is safe.

However, you should also be aware of how you retrieve the input. For example, what if the String contained a ", followed by executing PHP code. This would be an even worse vulnerability than malicious client-side code.

This post states old versions of IE may be vulnerable if your char-set is UTF-7, which it probably isn't.

If &lt;div style...&gt; is entered, it will be escaped. Therefore &lt;div&gt; and &lt;span&gt; should be included.

I believe every tag can have an onload=script, (E.G &lt;u onload="script"&gt;), so only allowing tags by themselves is a good idea. (As you are already doing)

I suggest adding div, span, b, br and many other tags to the whitelist.

Edit: Since you mentioned you use PHP to echo the output, I also suggest testing using PHP functions or variables  in the input, such as $_SERVER['REMOTE_ADDR']. 

Will the output show the result of that variable, or the literal text?