use html purifier for sanitation