The onChange event is called every time a change is made to the text, which is the best point to update the 'hidden' text.
Using the JS escape() function turns the text into (I can't remember the name) code that can be safely transferred to the server, keeping its integrity. The PHP function urldecode() is the PHP equivalent to the JS unescape().
Once it's back into normal text, you can do what you want ... either use it as 'real' html, i.e. to layout a page ... or display the html itself to the user using htmlspecialchars().
You don't need to escape/unescape all form data, but its a good idea for large pieces of text that needs to keep its integrity.