As to what tags to allow in message writing, might i suggest using Markdown. I'm using it within our CMS Application and am really happy with it. I think it covers a large enough subset of html that you wouldn't have to allow html at all, and it outputs valid xhtml.