also disallow some HTML characters