trust as html only when needed