handled XSS for md/wiki