def escape_tags(value, valid_tags):
<EOL>value = conditional_escape(value)<EOL>if valid_tags:<EOL><INDENT>tag_re = re.compile(r'<STR_LIT>' % '<STR_LIT:|>'.join(re.escape(tag) for tag in valid_tags))<EOL>value = tag_re.sub(_replace_quot, value)<EOL><DEDENT>value = value.replace("<STR_LIT>", "<STR_LIT>").replace("<STR_LIT>", "<STR_LIT>")<EOL>return mark_safe(value)<EOL>
Strips text from the given html string, leaving only tags.
        This functionality requires BeautifulSoup, nothing will be 
        done otherwise.

        This isn't perfect. Someone could put javascript in here:
              <a onClick="alert('hi');">test</a>

            So if you use valid_tags, you still need to trust your data entry.
            Or we could try:
              - only escape the non matching bits
              - use BeautifulSoup to understand the elements, escape everything else and remove potentially harmful attributes (onClick).
              - Remove this feature entirely. Half-escaping things securely is very difficult, developers should not be lured into a false sense of security.