[web] sanitize