use HtmlPurifier to avoid XSS