Thoughts

Well we are in the same boat right now.
I'm also trying to understand what's the safest way for WYSIWYG editor like tynyMCE
and end up reading htmlpurifier too but I came across this article.
http://www.dereuromark.de/2014/07/16/htm...or-bbcode/

So I'm going to use 'markdown'. This is the same editor tool currenly being  use in github.

Hope it helps

Thanks for the interesting link and then a sublink to tinymce. It is interesting this company has this page haha:
https://www.tinymce.com/docs/advanced/security/

You see their recommendation? :-P