Don't try to be a HTML santization hero