Wouldn't it be more desirable to have these WYSIWYG editors serialize to a non-HTML markup (like textile or markdown) to reduce the hassle of user-input sanitization on the back-end? (e.g. stripping script and iframe tags). What's best-practice these days for storing and displaying rich-edit user input?
I doubt Markdown, BBCode or anything similar is a good idea here. That's just introducing extra complexity - and what for? The point of markdown is that its simple for humans to read and write directly, which isn't applicable here. The downside to markdown should be obvious: * more code, both server and client-side (to implement the to-and-from conversion) * more bugs (due to more code and the complexity of escaping…
It's a hit on reddit, GitHub and more for a good reason. They could have whitelisted things as well, but they chose not to.