I have a problem with tinyMCE, it seems to store the stuff user create as html, so it can keep the fonts and iamges and stuff, however I have a problem, it seems a user can insert more then just photos and different fonts and symbols, a user can put buttons and event listeners and even javascript inside the text area of the text editor.

they cant simply type it in since it would become text, but if they copy+paste it inside it does not make it text but actual html stuff.

I tried to use escape() but it messes up the tinyMCE output even when the user does not create their own stuff.

How do I fix this and prevent the user from writing their own html stuff and only letting them use the functionality of the text editor(images, fonts, symbols and code, headers and quotes(kinda like stack-overflow))?

Thanks!