Excellent reading for web engineers: How to consume RSS safely.
Mark lists 10 HTML elements that must be stripped to safely display HTML from an RSS feed. He mentions stripping style attributes from RSS, but fails to mention an even more imporant set of attributes: the JavaScript event attributes.
Sure, you’ll want to leave <img> tags in the RSS feed, but what about those nasty onmouseover="..." attributes?