Fix a HTML injection