There's a couple of ways of doing it. The best way is to use strip_tags(), which in PHP4 allows you to add a third argument specifying which tags you will allow to be used while it removes everything else. If you're stuck in PHP3, you could always write a regular expression to search for all php3 tags and replace them with nothing.
It's worth pointing out that your user's input is NOT automatically evaluated as PHP code. In other words, if someone enters <? phpinfo() ?> into a form textarea input named "myinput" you can safely echo $myinput without executing phpinfo(). If you DO want to evaluate code entered by a user, call eval() on the input string.
