As a general rule you never really let the user use a WYSIWYG editor you give them a BBCode editor or something along those lines. Though if you use it tangent with a class to clean the html (as DeMo posted about HTML purifier) then I suppose it can still be used.

__________________
"What everyone seems to forget is that while knowledge certainly is something - it's the implementation of knowledge that brings power" - Andres Galindo.