$data =~ s/
          <                 # First '<'
           (?!              # Not followed by (Everything in this list
+ is allowed)
            (?:             # (with non-grouping parens)
             \/?br>         # A break tag
             |              # or
             \/?p>          # A paragraph tag
             |              # or
             \/?font[^>]*>  # A font tag
             |              # or
             \/?h[1-6]>     # A headline
            )               # Close non-grouping parens
           )                # End of negative lookahead
           (                # Capture to $1
            [^>]*           # Everything until the final '>'
           )                # End capture
          >                 # Final '>'
          /&lt;$1&gt;/gsix;
[download]

If you want to allow more HTML, just add the allowable elements in the negative lookahead list. This only allows very simple tags and has the benefit of you stating what you will allow, as opposed to stating what you won't allow (which has the risk of you overlooking something).

Also note that you want the entire document in the variable. If you run this line by line, someone could break the HTML up over several lines and beat the regex.

And for those who prefer it on one line:

$data =~ s/<(?!(?:\/?br>|\/?p>|\/?font[^>]*>|\/?h[1-6]>))([^>]*)>/&lt;
+$1&gt;/gsi;
[download]

Ovid patiently waits to be blasted for this one.

I really like the way Ovid broke up this regex with comments - I don't quite grok regexes yet, and things like this are very helpful to me. Maybe we'll see more of this in the future...hint hint...

Regexen can only handle subsets of HTML. To do the job properly you'll need to use HTML::Parser or one of its subsclasses.

I think the simplest solution is to 'literalize' HTML code, i.e. use substitution to turn angle brackets into their respective HTML ASCII tokens:

$evil_html =~ s/</&lt;/g;
$evil_html =~ s/>/&gt;/g;
[download]

%keepers = (
   '<p>'  => '#p#',
   '<br>' => '#br#',
   '<hr>' => '#hr#',
);
[download]

Works good, but, er, not so good for them font tags. You best bet is like davorg said, with HTML::Parser. The reason why I am posting this cargo-cult method is because you can quickly use the first substitition to make sure that your users do not abuse your BBS, while you are figuring out how to effectively use HTML::Parser.

hope this helps

Here's an example using HTML::TokeParser

#!/usr/bin/perl -w

use strict;
use HTML::TokeParser;

# Regex representing the list of acceptable tags
my $ok_stuff = qr/^(p|br|h.|font|pre)$/;

# Some test html.
my $html = "<p><br><h3><a href='evil.js'>Testing</a></h3></p>\n";

# Instantiate the TokeParser
my $parser = new HTML::TokeParser (\$html);

# Loop until all tokens are read
while (my $token = $parser->get_token())
{
        # Immediately print any "text" token
        if ($token->[0] eq "T")
        {
                print $token->[1];
        }
        # Check all other tokens against the regex before printing
        elsif ($token->[1] =~ $ok_stuff)
        {
                print $token->[$#{$token}];
        }
}
[download]

The above code prints out "<p><br><h3>Testing</h3></p>"

-Matt

Take a look at the Slashcode. They've got a nice tag-specific way of stripping HTML in Slash.pm.

It uses an array of permitted tags, and strips the rest.