I agree with @Jorn's answer about the validation.
However, you're still forgetting a very important step here, and that is output encoding.
In any event it shouldn't be either/or, its definitely both strict input validation + output encoding.
Now, if you are referring to including "safe" HTML tags in the output (then its not very clear in your question), then you should still encode every thing, and then decode the specific tags you're looking for without any of the tag's attributes.
P.s. If you're referring to a .NET app, MS's AntiXSS (in WPL) provides a
.GetSafeHTMLXXX set of methods.