A Norwegian social site back in the days called Nettby ("net-city") also allowed some html, but did it by just removing unallowed tags. I realised I could write <scr<script>ipt>, and after it did the removal of the first script tag I still had one.

This trick still works on surprisingly many sites. Allowing custom html is hard, so think long before rolling your own.