how wmd avoid the js injection?

Question

How to avoid the wmd editor's js injection?

Code like below:

<

a href="http://www.abc.com">abc</a>

<br />

<script>alert('hello')</script>