I think it will be easyer to do it as follows:
use htmlspecialchar to make sure every html-attribute is "disabled"
then check the post for every [b ] (for instance) and replace that with <b>. You can do that with every [ think of something ] you want.
You can use str_replace
, to replace those brackets.
it will be much more difficult to check for special html-entities and exclude them from htmlspecialchar than using [brackets]