Preventing XSS (Cross-site Scripting)
If you are not looking to use an editor you might consider OWASP's AntiSamy.
You can run an example here: http://www.antisamy.net/
How much HTML are you going to support? Just bold/italics/the basic stuff? In that case, you can convert those to markdown syntax and then strip the rest of the HTML.
The stripping needs to be done server side, before you store it. You need to validate the input on the server as well, when checking for SQL-vulnerabilities and other unwanted stuff.