The CKEditor security system protects you from executing malicious code that is already in your database. In plain textareas database content is harmless because it is not executed, but the CKEditor WYSIWYG editor interprets HTML like a web browser and thus the content needs to be filtered before it is loaded.
<strong>
<a>
<b>
<img>
Example: object[width,height];param[name,value];embed[*];
object[width,height];param[name,value];embed[*];
p;div;pre;address;h1;h2;h3;h4;h5;h6
<pre>
style.css
"css/editor.css"
"/themes/garland/style.css,http://example.com/style.css"
%h
/
%t
/sites/all/themes/fh/
ckeditor.styles.js
sites/all/modules/contrib/ckeditor/ckeditor.styles.js
sites/all/themes/fh/ckeditor.styles.js
/ckeditor.styles.js
%m
sites/all/modules/contrib/ckeditor
%b
%f
sites/default/files
%u
%n
/sites/default/files/
%d
/code
/code/sites/default/files/
ckeditor.config.js
sites/all/modules/contrib/ckeditor/ckeditor.config.js
config.font_names = 'Arial;Times New Roman;Verdana'; config.fontSize_sizes = '16/16px;24/24px;48/48px;';