Is it ok not to clean user input in this situation (PHP/MySQL)?

I always run user supplied input through both the html entities and mysql real escape string functions.

But now I am building a CMS which has a WYSIWYG editor in the admin section. I noticed that using htmlentities() on the WYSIWYG edited user content removed all styles and throws a bunch of quotes on the front end article page (as can be expected).

So is it ok to not clean the html/javascripts entered by the user in this situation? I will still use mysql_real_escape_string() which doesn't conflict.

Although the admin in the only one who will have access to the back end, I can think of at least one scenario where suppose a hacker somehow got access to the create a post page, now although they can wreak havoc by delet开发者_运维问答ing posts, etc, instead they choose to use this as an opportunity to send visitors to his site by making this post:

<script>window.location = "http://evilsite.com"</script>

So what should I do? and also are there any functions that will disable javascript but not html and inline css?

The WYSWYG is TinyMCE by the way.

It is never OK to not clean user input. Anybody can sabotage your system, just like you hypothesized. This kind of risk is simply not worth taking.

Although, for your case it would depend on the WYSIWYG editor you use. Look around TinyMCE's documentation or ask around, and see what it says about displaying/rendering HTML output in its rich text editor with regards to XSS vulnerabilities.