remove unsafe html injection