Try Texy!

safe mode

<IMG SRC="javascript:alert('XSS');">

Text formatted with Texy:

Generated HTML code:

<div><img src="javascript:alert('XSS');"></div>

Texy 3.2.8 (configuration)