I recently found Caja which looks like an effective way of preventing XSS. From their site:
The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your website. It enables rich interaction between the embedding page and the embedded applications. Caja uses an object-capability security model to allow for a wide range of flexible security policies, so that your website can effectively control what embedded third party code can do with user data.
Caja turns a piece of Web content -- roughly, a snippet of HTML, CSS and JavaScript that you would see within the body tag of an HTML page -- into a Caja module. This module is represented as a single JavaScript module function that can be run within a Caja container.
Does this mean that using Caja I could give a user the ability to enter HTML/CSS without having to worry about possible XSS attacks?