Best way to prevent xss attack

i have editor which external user will use to create page. now wicked person can inject something malicious. so tell me how to prevent it?

i will allow user to upload any string data but how could i show it in page as a result html will display nicely but if there js code that will not be executed....just display html.

how to exclude script section from html data when displaying in page. thanks