This isn't actually good advice, since it implies that blacklist-based tag filtering is a good approach, and also assumes that sanitization (rather than escaping) is the way to go, which is very rarely true in client-side JS.

This comment should just advocate escaping (using `Y.Escape.html()`) and leave it at that. Actual HTML sanitization is way out of scope.