title: How to prevent XSS (Cross Site Scripting) whilst allowing HTML input
body: <p>I have a website that allows to enter HTML through a <a href="http://www.tinymce.com/" rel="noreferrer">TinyMCE</a> rich editor control. It's purpose is to allow users to format text using HTML.</p>
  
  <p>This user entered content is then outputted to other users of the system.</p>
  
  <p>However this means someone could insert JavaScript into the HTML in order to perform a XSS attack on other users of the system.</p>
  
  <p><strong>What is the best way to filter out JavaScript code from a HTML string?</strong>  </p>
  
  <p>If I perform a Regular Expression check for <code>&lt;SCRIPT&gt;</code> tags it's a good start, but an evil doer could still attach JavaScript to the <code>onclick</code> attribute of a tag.</p>
  
  <p>Is there a fool-proof way to script out all JavaScript code, whilst leaving the rest of the HTML untouched?</p>
  
  <p>For my particular implementation, I'm using C#</p>