The usual way to handle something like this, particularly if you don't know what will cause harm, is to select a set of tags and attributes that should be allowed and remove everything else.

For an example: see perlmonks. Below the input box is the list of tags that will work. The reason they do this is simple: who knows what might cause harm? But we can be reasonably certain the strong and emphasis tags are ok.