SECURITY : secure input and allow embed