The point of all this is that you can safely run untrusted javascript code on your site and not have someone malicious wreak havok.

Now there is a way to allow users to actually supply you with html markup and not have to do anything special filtering-wise on your backend.

see: http://pdos.csail.mit.edu/6.858/2011/labs/lab6.html