Sanitize HTML on backend