stop HTML/JS injections