Potentially harmful HTML

Question

I am writing a Web application that is going to be used to handle email requests.
I have written an application that I have running on a server that retrieves the emails and puts all of the information into my database including the body of the email.
I can load the email body text into a textbox and it displays correctly without hyperlinks etc.  but when I submit any actions on the page I am getting an error telling me I may have opened myself up to harmful stuff.  if I load it into a label,
it eliminates this, but also eliminates the line breaks and paragraphs of the email.  kindof hard to read.
I figure it is pretty likely that I will at the very least get some spam that has some malicious html in it.
So what is the best way to protect myself?  is there a way to parse through the text to remove anything harmful while leaving the basic formatting in place?
here is the data coming from the database for one of the emails:
Test email.
First Last
Company
(000)000-00000 Office
[phone] Mobile
[email protected]
www.email.com<http://www.email.com>
<http: www.caglewood.org=""></http:>

Answer 1

toStaticHTML method is god but still IE only. The following code works on other browsers too. Method does pretty much the same thing, and is pretty fast too. 
This is a simple HTML String Sanitizing tool.
It allows a highly rich,- but safe - html content input to be published on your pages.
The script code is very light and to some degree customizable.
This function takes care of blacklisted tags, which are the first to be discarded without further processing.
Otherwise, it checks link protocols for code injection, and strips it off if JavaScript is encountered.
Further on, it removes all event driven code assignments from event attributes on all tags.
And lastly, it restores images after stripping their event attributes. This security step is taken directly on the string source, because images are able to trigger the onerror event on
a faulty source as soon as they are converted to DOM Elements, - making it possible for the attacker to execute his malicious code even before appending it to the document. This is the only part of the measure that operates on a string level. But it's absolutely,
- a necessary one!
All questions, suggestions or remarks, are welcome...
p.s.: I decided to also restrict the use of inline style, -since earlier versions of IE do support JavaScript returned values on this property.
function sterilize(HTMLString){ /* b.b. Troy III p.a.e. */
HTMLString=HTMLString.replace( /<img /gi, "<imga ");
var att, x=0, y, coll,c=[],
probe = document.createElement("div");
probe.innerHTML = HTMLString;
coll = probe.getElementsByTagName("*");
while(coll[x])coll[x]?c.push(coll[x++]):0;
for( x in c )
if( /(script|object|embed|iframe)/i.
/*you can blacklist more tags here!*/
test( c[x].tagName ) ){
c[x].outerHTML="";
} else {
if( c[x].href)/java/.test(coll[x].protocol )?c[x].href="#":0;
att = c[x].attributes;
for( y in att ) if(att[y])
if( /(^on|style)/i.test(att[y].name) )
c[x].removeAttribute( att[y].name );
c=probe.innerHTML.replace( /imga/gi, "img" );
return c.replace( /<\/img>/gi, "" );
I'm using blacklist instead of whitelist here, why? 
I think there was a reason behind this decision...
Its about freedom
And freedom is about more choices, more opportunities, more solutions and so forth.
To my humble opinion -there are always more good people, than bad.
Henceforth, contrary to the widespread policy/opinion that treats them all as equally evil, yet privilege the most unworthy ones - in reality and in practice, it is always just, and easier
than anything else - to restrain the evil ones only, and let others enjoy.
The freedom where you are free to do nothing, is no freedom at all.
-It's a quarantine!
My natural borne idea was/is to make freedom enjoyable. (For, what good is freedom that you cant enjoy?!)
Anyway,
as mentioned earlier, - "to some degree" - the code is also customizable;
and so is its policy 
-which can easily be inverted:
// just add the "!" [NOT] mark here and fill in your whitelist:
for( x in c )
if( ! /(/*your white-list here*/)/i.
//and continue;
than comment out the "else" part completely:
// } else {
and you got yourself a privileged list of tags allowed, instead.
p.s.
You might notice that - depending on "how you look at freedom", - the privileged list will
tend to extend far beyond the length of its opposite.
Best Regards.