I know you said you wanted to keep certain HTML tags, but this solution will work in the meantime.

I think the simplest solution is to 'literalize' HTML code, i.e. use substitution to turn angle brackets into their respective HTML ASCII tokens:

$evil_html =~ s/</&lt;/g;
$evil_html =~ s/>/&gt;/g;
[download]

But this will, of course, hose all of your HTML code. One thing you could do is substitute the tags you want to keep into something that won't get hosed:

%keepers = (
   '<p>'  => '#p#',
   '<br>' => '#br#',
   '<hr>' => '#hr#',
);
[download]

Substitute these values in the code globaly and case- insensitive, then perform the first substitution above, then substitute these values back to their original form.

Works good, but, er, not so good for them font tags. You best bet is like davorg said, with HTML::Parser. The reason why I am posting this cargo-cult method is because you can quickly use the first substitition to make sure that your users do not abuse your BBS, while you are figuring out how to effectively use HTML::Parser.

hope this helps