title: For setHTML() method, is it still safe If we do not use Safehtml but we validate the String & only accept some limited html tag (Gwt)?
body: <p>Any widget that has setHTML method could give a hole in security system, but if we validate String &amp; only accept some limited html tags such as <code>&lt;b&gt;, &lt;i&gt;...</code>. And then we put this string into setHTML method.</p>
  
  <p>Then my question is "is it still safe if we do that"
  For example, we check the String text to make sure it only contain some limited html tags <code>&lt;b&gt;, &lt;/b&gt;, &lt;i&gt;, &lt;/i&gt;..</code>. If the string text contain other tags then we won't let uses to input that text. Then we use:
      <code>html1.setHTML(text);</code>  instead of <code>html1.setHTML(SafeHtmlUtils.fromString(text))</code></p>
  
  <p>i don't know why <code>html1.setHTML(SafeHtmlUtils.fromString(text))</code> does not generate the formatted text, it just shows plain text when i run it in eclipse? For example</p>
  
  <pre><code>html1.setHTML(SafeHtmlUtils.fromString("&lt;b&gt;text&lt;/b&gt;")) 
  </code></pre>
  
  <p>will have plain text result <code>&lt;b&gt;text&lt;/b&gt;</code> instead of bold text "<b>text</b>" with correct html format</p>