Is it really intended behavior, that we allow html content here? Because this will make us vulnerable to Cross-Site-Scripting. Or do we trust our admins? If we don't actually wan't to allow html (and javascript) content here but want to maintain the format of the text the user put in simple_format could be used, wich will convert line breaks to <br /> tags and paragraphs.