What do you do with html injections?

[eluser]PhilTem[/eluser]
For user input: Prepare the post-variables to not contain any harmful code (use e.g. xss-filtering)

For user output: Easiest way is to use htmlentities to convert each character to its corresponding html-entity. & turns to &, ...
A more advanced approach is to use something like http://htmlpurifier.org because you have more control over how the original input data will be changed.