Regarding the first question, many javascript WYSIWYG editors are available. I found this site on Google: http://www.htmlarea.com/directory/Web_Software_Components/WYSIWYG_Editors/
Regarding your second question, do the html_escape before the textilize: h(text_from_user).textilize
Dan Manges