global xss filtering and video embeds

[eluser]treadsoftley[/eluser]
I have global xss filtering enabled and this is something I would like to maintain, however,
video embeds are then rendered useless as the ascii equivalents are displayed eg % 2 C (spaced here) appears as a comma.

Of course, 'html_entity_decode()' does do this but then loads of spurious question marks appear in the text where it cannot decode such things as an ampersand between two para tags and anyway I would like to be more specific as to what I want to allow and where.

Does anyone know of a regex function that can restore the embed when the page is displayed?

Tia.