- When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (`<b>`, `<i>`, `<u>`, ...etc.) ?