I want to enable users to use widgets on my site, such as Youtube. The code syntax for these widgets is:

<object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/p4cP2oy4ebE"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/p4cP2oy4ebE" type="application/x-shockwave-flash" wmode="transparent" width="425" height="350"></embed></object>

So, now users may insert the <object>,<param> and <embed> tags, but is there ANY way that I can still allow users the usage of widgets but prevent the insertion of malicious code?
How did other sites solve this issue?

Thanks!