<p>This link describes an exploit into my app using fckEditor:
<a href="http://knitinr.blogspot.com/2008/07/script-exploit-via-fckeditor.html" rel="nofollow noreferrer">http://knitinr.blogspot.com/2008/07/script-exploit-via-fckeditor.html</a></p>

<p>How do I make my app secure while still using fckEditor?   Is it an fckEditor configuration?   Is it some processing I'm supposed to do server-side after I grab the text from fckEditor?</p>

<p>It's a puzzle because fckEditor <em>USES</em> html tags for its formatting, so I can't just HTML encode when I display back the text.</p>

The bug is not actually FCKeditors fault. As long as you let users edit HTML that will be displayed on your web site they will always have to possibility to do harm unless you check the data before you output it.
Some people use HTMLencoding to do this, but that will destroy all the formatting done by FCKeditor, not what you want.
Maybe you can use the
Microsoft Anti-Cross Site Scripting Library
. Samples on
MSDN