sanitize html for save