sql in html removed