The span tag isn't actually a safe tag